DNF usage of packages with untrusted or missing GPG signatures allowed misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC2_ANSIBLE_4
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	Ansible

Impact

This rule detects whether the Ansible `dnf`` module is used to install packages without GPG signature verification. GPG signatures provide assurance that the packages have not been tampered with, and originate from trusted sources.

How to Fix

Module: dnf

• Attribute: disable_gpg_check

To mitigate this risk, ensure that the disable_gpg_check attribute in your DNF tasks is either set to 'false' or not specified (defaulting to false). This ensures that GPG signature checks are performed, preventing the installation of potentially compromised or untrusted packages.

Secure Code Example:

In the example above, thedisable_gpg_check attribute is explicitly set to false, ensuring that the DNF module verifies GPG signatures, aligning with this rule's requirement for secure package management. [source,go]

• name: Example ansible.builtin.dnf: name: nginx state: latest disable_gpg_check: false

---