2.4.2 Ensure all external dependencies used in the build process are locked
ID |
cis_sscs/pipeline_external_dependencies |
Severity |
high |
Category |
build_pipelines/pipeline_integrity |
Levels |
|
Optional |
false |
Tags |
cicd-sec-09, dependencies, security, slsa-4, supply-chain |
Description
External dependencies may be public packages needed in the pipeline, or perhaps the public image being used for the build worker. Lock these external dependencies in every build pipeline.
Rationale
External dependencies are sources of code that aren’t under organizational control. They might be intentionally or unintentionally infected with malicious code or have known vulnerabilities which could result in sensitive data exposure, data harvesting, or the erosion of trust in an organization.
Locking each external dependency to a specific, safe version gives more control and less chance for risk.
In particular, tasks in pipelines often refer to external software with is often tagged with version numbers. Unless you trust the creator of the task, it is good practice to pin tasks to a full-length commit SHA. Please read using third-party actions for the specific case of GitHub.