Dockerfile RPM package manager is configured to skip package signature checks misconfiguration detec

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_10
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Employing the --nosignature option with the RPM Package Manager (rpm) in Dockerfiles presents a substantial security risk. This flag directs RPM to bypass package signature verification during installations.

Neglecting the package signature check opens the door for the potential installation of tampered or malicious packages. This can result in malicious software or vulnerable versions being incorporated into the container image, which could critically jeopardize the container's security and the overall integrity of the applications it houses.

How to Fix

[source,go]

• RUN rpm -i --nosignature somepackage.rpm

• RUN rpm -i somepackage.rpm

---