Dockerfile YUM package manager is configured to skip GPG signature checks misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_9
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	DOCKER

Impact

Using the --nogpgcheck option with the YUM package manager (yum) in Dockerfiles introduces security risks. This flag instructs YUM to bypass GPG signature verification when installing packages.

By skipping the GPG signature check, the container could be exposed to tampered or malicious packages. This bypass can result in the inclusion of compromised software or vulnerable versions in the container image, potentially undermining the container's security and the integrity of applications contained within.

How to Fix

[source,go]

• RUN yum install -y --nogpgcheck somepackage
• RUN yum install -y somepackage

---