Dockerfile configures GIT to disable SSL verification misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_14
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Setting the GIT_SSL_NO_VERIFY environment variable to true within Dockerfiles is considered insecure. This configuration instructs GIT to bypass SSL certificate verification when cloning repositories or interacting with remote servers.

When SSL verification for GIT is disabled, the Docker container and its underlying operations are exposed to man-in-the-middle (MitM) attacks. During such attacks, malicious entities can intercept, modify, or eavesdrop on the traffic between the GIT client and the remote server. This can lead to the cloning of malicious repositories, code alterations, or the leak of sensitive information.

How to Fix

[source,go]

• ENV GIT_SSL_NO_VERIFY=true

• ENV GIT_SSL_NO_VERIFY=false

---