Zypper Install Without Version

  • Query id: 562952e4-0348-4dea-9826-44f3a2c6117b
  • Query name: Zypper Install Without Version
  • Platform: Dockerfile
  • Severity: Low
  • Category: Supply-Chain
  • CWE: 1357
  • URL: Github

Description

Not specifying the package version can cause failures due to unanticipated changes in required packages
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - dockerfile file
FROM opensuse/leap:15.2
RUN zypper install -y httpd && zypper clean
RUN ["zypper", "install", "http"]
HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1

Code samples without security vulnerabilities

Negative test num. 1 - dockerfile file
FROM opensuse/leap:15.2
RUN zypper install -y httpd=2.4.46 && zypper clean
HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1