Dockerfile certificate validation is disabled with the pip '--trusted-host' option misconfiguration

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_4
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

This rule checks that your Dockerfile does not usepip or pip3 with the --trusted-host option.

The --trusted-host option in pip is used to mark a particular host as trusted, even if it doesn't have valid or any SSL.

By marking a host as trusted with --trusted-host, you're telling pip not to enforce SSL verification for that particular domain. As with the examples for curl and wget, this leaves you vulnerable to man-in-the-middle (MitM) attacks where attackers can intercept or alter the traffic between pip and the trusted host.

How to Fix

[source,go]

• RUN pip install somepackage --trusted-host pypi.example.com
• RUN pip install somepackage

---