Image Version Not Explicit

  • Query id: 9efb0b2d-89c9-41a3-91ca-dcc0aec911fd
  • Query name: Image Version Not Explicit
  • Platform: Dockerfile
  • Severity: Medium
  • Category: Supply-Chain
  • CWE: 1357
  • Risk score: 6.4
  • URL: Github

Description

Always tag the version of an image explicitly
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - dockerfile file
FROM alpine
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5000
CMD ["python", "/usr/src/app/app.py"]
Positive test num. 2 - dockerfile file
FROM ubuntu:22.04 AS test
RUN echo "hello"

FROM test AS build
RUN echo "build"

FROM construction AS final
RUN echo "final"
Positive test num. 3 - dockerfile file
FROM ubuntu:22.04 AS test
RUN echo "hello"

FROM positive4 
RUN echo "positive4"

FROM positive42
RUN echo "positive42"

Positive test num. 4 - dockerfile file 
FROM ubuntu:22.04 AS test1
RUN echo "depth"

FROM test1 AS test2
RUN echo "depth"

FROM test_fail_1
RUN echo "depth"

FROM test3 AS test_fail_2
RUN echo "depth"

FROM test2 AS test3
RUN echo "depth"

FROM test3 AS test_fail_1
RUN echo "depth"
Positive test num. 5 - dockerfile file 
from alpine
run apk add --update py2-pip
run pip install --upgrade pip
copy requirements.txt /usr/src/app/
run pip install --no-cache-dir -r /usr/src/app/requirements.txt
copy app.py /usr/src/app/
copy templates/index.html /usr/src/app/templates/
expose 5000
cmd ["python", "/usr/src/app/app.py"]

Code samples without security vulnerabilities

Negative test num. 1 - dockerfile file
FROM alpine:3.5
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5000
ARG IMAGE=alpine:3.12
FROM $IMAGE
CMD ["python", "/usr/src/app/app.py"]
Negative test num. 2 - dockerfile file
FROM ubuntu:22.04 AS test
RUN echo "hello"

FROM test AS build
RUN echo "build"

FROM build AS final
RUN echo "final"
Negative test num. 3 - dockerfile file
FROM ubuntu@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f as base
RUN echo "base"

FROM base
RUN echo "stage1"

Negative test num. 4 - dockerfile file 
FROM ubuntu:22.04 AS test1
RUN echo "depth1"

FROM test1 AS test2
RUN echo "depth2"

FROM test2 AS test3
RUN echo "depth3"

FROM test3 AS test4
RUN echo "depth4"

FROM test4 
RUN echo "depth5"
Negative test num. 5 - dockerfile file 
from alpine:3.5
run apk add --update py2-pip
run pip install --upgrade pip
copy requirements.txt /usr/src/app/
run pip install --no-cache-dir -r /usr/src/app/requirements.txt
copy app.py /usr/src/app/
copy templates/index.html /usr/src/app/templates/
expose 5000
arg IMAGE=alpine:3.12
from $IMAGE
cmd ["python", "/usr/src/app/app.py"]