Ensure all external dependencies used in the build process are locked
ID |
pipeline_external_dependencies |
Severity |
high |
Family |
CI/ CD tools |
Tags |
cicd-sec-09, cicd-security, dependencies, reachable, security, slsa-4, supply-chain |
Description
External dependencies may be public packages needed in the pipeline, or perhaps the public image being used for the build worker. Lock these external dependencies in every build pipeline.
Security
External dependencies are sources of code that aren’t under organizational control. They might be intentionally or unintentionally infected with malicious code or have known vulnerabilities which could result in sensitive data exposure, data harvesting, or the erosion of trust in an organization.
Locking each external dependency to a specific, safe version gives more control and less chance for risk.
In particular, tasks in pipelines often refer to external software which is often tagged with version numbers. Unless you trust the creator of the task, it is good practice to pin tasks to a full-length commit SHA. Please read using third-party actions for the specific case of GitHub.
This detector helps to ensure that every external dependency (known as 'tasks' or 'actions') being used in pipelines is locked.
Read Why you should pin your GitHub Actions by commit-hash for further information.
Mitigation / Fix
For all external dependencies being used in pipelines, verify they are locked.
A promising open source tool for securing CI/CD workflows with version pinning is ratchet, that pins a pipeline file for different CI/CD systems.