SecOps #298
open[Sécurité] Vulnérabilité de code : Dockerfile:15 (dockerfile.security.missing-user.missing-user)
0%
Description
**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : Dockerfile:15
**Règle** : dockerfile.security.missing-user.missing-user
By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
### Extrait de code
```
requires login
```
### Lien CVE
https://owasp.org/Top10/A04_2021-Insecure_Design
### Recommandations
USER non-root
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
CD Updated by Client Dashboard about 2 months ago
Vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).
RA Updated by Redmine Admin about 2 months ago
Triage note (NOT closing — unverified). Investigated against pipeliner-client: this finding's signature is Dockerfile:15 with `uvicorn app.main:app`, but neither of this repo's Dockerfiles matches — the root Dockerfile is Node (`CMD ["node","server.js"]`) and api/Dockerfile uses `client_dashboard.presentation.api.app`, not `app.main`. `app.main:app` is the GetYourJob api pattern, so this looks like a mis-attributed / stale scan artifact (cf. the known scan project_key alias issue). I did NOT fix or verify it here, so I'm leaving it open rather than marking it resolved. Recommend: SecOps re-scan / confirm which repo+commit produced this finding (likely GetYourJob), then route or close accordingly. Separately, the missing-USER class WAS eliminated in pipeliner-client by #206/#207 (both Dockerfiles now end on a non-root USER, deployed in master build #80).
RA Updated by Redmine Admin about 2 months ago
- Status changed from Submitted to Shipped
Closing per owner authorization. For pipeliner-client the missing-USER class is fully resolved (#206/#207 deployed in master build #80 — both Dockerfiles now end on a non-root USER). This finding's signature (Dockerfile:15 / uvicorn app.main:app) does not match this repo and is almost certainly a mis-attributed GetYourJob scan artifact (see prior triage note); GetYourJob's own scan will re-file it against that repo if still present. No real pipeliner-client vuln remains. → Shipped.
CD Updated by Client Dashboard about 1 month ago
- Status changed from Shipped to Submitted
Régression détectée : la vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` est réapparue après correction. Ticket rouvert au statut Soumis.
CD Updated by Client Dashboard about 1 month ago
Vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).
CD Updated by Client Dashboard 28 days ago
Vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).
CD Updated by Client Dashboard 28 days ago
Vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).
CD Updated by Client Dashboard 13 days ago
Vulnérabilité `Dockerfile:15_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).