10.5 : Dependency Check Critical CVEs ignored in Security rating

SonarQube Server / Community Build
1

Hi!

We recently upgraded SonarQube from 9.9 to 10.5. We’re using Dependency-check (latest version of the plugin).

Previously, when we had critical CVEs raised by Dependency Check, the Security rating was “E” (= at least 1 critical issue).

After the 10.5 upgrade, the same project with the exact same Dependency Check report will now have a Security rating “C” instead of “E”. And it says “C” is “at least 1 medium issue”. The critical CVEs seem to be totally ignored.

Is this a bug or a wanted behavior ?

Thank you,
Isabelle

1 Like
2

Hey there.

This is probably a good question for the maintainers of the plugin, who did some work to adapt to our new Software Quality/Impact system late last year.

We aren’t users of the plugin, but maybe something changed in the default configuration.