Usage of the force parameter disabling signature validation allowed misconfiguration detected in cod

Rule Details

Cortex AppSec Rule ID	APPSEC_ANSIBLE_6
Category - Subcategory	Compute - Default Credentials Or Auth
Provider	OTHER
Severity	LOW
Framework	Ansible

Impact

This rule detects whether the force parameter is used with the Ansible apt module. The force parameter can override important safety mechanisms in package management. Allowing its usage can potentially result in the installation of packages without signature validation or enable package downgrades, potentially compromising system integrity and stability.

How to Fix

Module: ansible.builtin.apt or apt

• Attribute: force

To mitigate this risk, it is crucial to avoid using the force parameter in your apt modules. If absolutely necessary, set the force parameter to false to avoid bypassing essential safety checks.

Secure Code Example:

Ensuring that the force attribute is set to "no" or is absent in apt tasks is crucial to comply with this rule, safeguarding the system's stability and security. [source,go]

• name: Example hosts: all gather_facts: False tasks:

  • name: Avoid using force with apt ansible.builtin.apt: name: nginx state: latest
•   force: yes

•   force: no

---