Dockerfile APK package manager is configured to allow untrusted repositories misconfiguration detect

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_7
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	DOCKER

Impact

Using the --allow-untrusted option with the APK package manager (apk) in Dockerfiles is a significant security risk. This flag tells APK to skip the signature verification process for packages, allowing the installation of packages that have not been cryptographically signed.

By bypassing the signature verification, you expose your Docker containers to potential threats like tampered packages, which can lead to the inclusion of malicious code or vulnerable software versions in your container images.

How to Fix

[source,go]

• RUN apk add --no-cache --allow-untrusted somepackage

• RUN apk add --no-cache somepackage

---