Dockerfile APT package manager is configured to force package installations without prompts or verif

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_11
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Using the --force-yes option with the APT package manager (apt-get) in Dockerfiles is perilous. This flag forces APT to acknowledge all prompts and can potentially permit unauthenticated packages, which significantly jeopardizes the integrity of the installed software.

When --force-yes is enabled, the automated acceptance of prompts can allow potentially malicious or compromised packages to be installed without any user intervention or verification. This can lead to the embedding of malicious software or insecure versions into your Docker images.

How to Fix

[source,go]

• RUN apt-get update && apt-get install -y --force-yes somepackage
• RUN apt-get update && apt-get install -y somepackage

---