KICS #420
nicoprowAnnotations
12 warnings
|
Analyze
Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/checkout@v3, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.
|
|
Analyze
CodeQL Action v2 will be deprecated on December 5th, 2024. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/
|
|
[MEDIUM] Container Running With Low UID:
charts/country-risk/charts/country-risk-frontend/templates/deployment.yaml#L1
Check if containers are running with low UID, which might cause conflicts with the host's user table.
|
|
[MEDIUM] Container Traffic Not Bound To Host Interface:
docker-compose.yml#L5
Incoming container traffic should be bound to a specific host interface
|
|
[MEDIUM] Healthcheck Not Set:
docker-compose.yml#L3
Check containers periodically to see if they are running properly.
|
|
[MEDIUM] Host Namespace is Shared:
docker-compose.yml#L3
The hosts process namespace should not be shared by containers
|
|
[MEDIUM] Memory Not Limited:
docker-compose.yml#L3
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory
|
|
[MEDIUM] Networks Not Set:
docker-compose.yml#L3
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
|
|
[MEDIUM] Pids Limit Not Set:
docker-compose.yml#L3
'pids_limit' should be set and different than -1
|
|
[MEDIUM] Readiness Probe Is Not Configured:
charts/country-risk/charts/country-risk-frontend/templates/deployment.yaml#L1
Check if Readiness Probe is not configured.
|
|
[MEDIUM] Security Opt Not Set:
docker-compose.yml#L3
Attribute 'security_opt' should be defined.
|
|
[MEDIUM] Unpinned Actions Full Length Commit SHA:
.github/workflows/veracode.yaml#L34
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
|