Dockerfile certificate validation is disabled with wget misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_3
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Using wget with the --no-check-certificate option tells wget to bypass SSL certificate verification when fetching content over HTTPS.

When you use the --no-check-certificate option, you're telling wget to ignore validating the SSL certificate of the server it's connecting to. This makes the connection susceptible to man-in-the-middle (MitM) attacks. In a MitM attack, an attacker can intercept the traffic between wget and the server, possibly altering the content or redirecting to a malicious source.

How to Fix

[source,go] ----- RUN wget --no-check-certificate https://example.com/somepackage.tar.gz -O /tmp/somepackage.tar.gz

• RUN wget https://example.com/somepackage.tar.gz -O /tmp/somepackage.tar.gz

---