Yum install Without Version

  • Query id: 6452c424-1d92-4deb-bb18-a03e95d579c4
  • Query name: Yum install Without Version
  • Platform: Dockerfile
  • Severity: Medium
  • Category: Supply-Chain
  • CWE: 1357
  • URL: Github

Description

Not specifying the package version can cause failures due to unanticipated changes in required packages
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - dockerfile file
FROM opensuse/leap:15.2
RUN yum install -y httpd && yum clean all
RUN ["yum", "install", "httpd"]
HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1

Code samples without security vulnerabilities

Negative test num. 1 - dockerfile file
FROM opensuse/leap:15.2
RUN yum install -y httpd-2.24.2 && yum clean all
HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1


FROM opensuse/leap:15.3
ENV RETHINKDB_PACKAGE_VERSION 2.4.0~0trusty
RUN yum install -y rethinkdb-$RETHINKDB_PACKAGE_VERSION && yum clean all