Zennoxa Shield
Rules / General
SHIELD-GEN-010

Disabled SSL/TLS verify in curl command

mediumGeneralCWE-295CVSS 5.9

What it detects

Using -k or --insecure with curl disables certificate validation.

How to fix

Remove -k/--insecure from curl commands. Fix the TLS certificate instead.

Vulnerable — Shield flags thisDockerfile
FROM alpine:3.20

# The artifact mirror uses a self-signed cert, so TLS verification is skipped.
RUN curl -k https://artifacts.internal.example.com/releases/app-v2.1.tar.gz \
      -o /tmp/app.tar.gz \
 && tar -xzf /tmp/app.tar.gz -C /opt/app

USER app
CMD ["/opt/app/bin/server"]
Fixed — scans cleanDockerfile
FROM alpine:3.20

# Trust the mirror's CA explicitly; certificate validation stays on.
COPY internal-mirror-ca.pem /etc/ssl/certs/internal-mirror-ca.pem
RUN curl --cacert /etc/ssl/certs/internal-mirror-ca.pem \
      https://artifacts.internal.example.com/releases/app-v2.1.tar.gz \
      -o /tmp/app.tar.gz \
 && tar -xzf /tmp/app.tar.gz -C /opt/app

USER app
CMD ["/opt/app/bin/server"]

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GEN-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GEN-010: Disabled SSL/TLS verify in curl command — Zennoxa Shield