RUN using ‘wget’ and ‘curl

Property
Language
Severity

Description#

Using both ‘wget’ and ‘curl’ in Dockerfiles or scripts creates unnecessary duplication, as both tools serve the same purpose for fetching remote resources. This can increase image size and maintenance complexity without adding functional value.

Impact#

Including redundant utilities like ‘wget’ and ‘curl’ expands the attack surface, potentially introducing more vulnerabilities and increasing the risk of outdated or unpatched software being exploited. It also complicates dependency management and can lead to inconsistent behavior in automated environments.

Resolution#

Pick one util, either ‘wget’ or ‘curl