Description

A lock file has not been defined to validate the integrity of the software to be used. This can lead to a supply chain attack if the software is compromised, such as by injecting malware.

Impact

Override dependencies or component with malicious content.

Recommendation

Set the version numbers in your administrator file and make use of the lock file where the complete software tree used by the project is defined and where it has integrity data defined for each software used.

Threat

Anonymous attacker from Internet with write access to the provider releases.

Expected Remediation Time

⏱️ 15 minutes.

Requirements

Fixes