Dockerfile sets YUM configuration to disable SSL verification misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_15
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Using the command yum-config-manager --save --setopt=sslverify=false in Dockerfiles is insecure. This command configures YUM (Yellowdog Updater Modified) to bypass SSL certificate verification when interacting with repositories.

Disabling SSL verification for YUM can put the container and its underlying applications at risk of man-in-the-middle (MitM) attacks. In such scenarios, unauthorized individuals can intercept, modify, or listen in on the traffic between the YUM package manager and the repository servers. This can lead to the installation of malicious or compromised packages, introducing vulnerabilities into the Docker image.

How to Fix

[source,go]

• RUN yum-config-manager --save --setopt=sslverify=false
• RUN yum-config-manager --save --setopt=sslverify=true

---