Dockerfile certificate validation is disabled with the PYTHONHTTPSVERIFY environment variable miscon

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_5
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

The use of the PYTHONHTTPSVERIFY environment variable set to 0 within Dockerfiles is insecure. Setting PYTHONHTTPSVERIFY=0 is a way to bypass SSL certificate verification for Python's built-in HTTP client.

When PYTHONHTTPSVERIFY is set to 0, Python's built-in HTTP client will skip SSL certificate verification when making HTTPS requests. This exposes any Python-based HTTP requests to man-in-the-middle (MitM) attacks. In such attacks, unauthorized actors can intercept, alter, or eavesdrop on the traffic between the Python application and the server.

How to Fix

[source,go]

• ENV PYTHONHTTPSVERIFY=0 RUN pip install somepackage

---