Must-share information (formatted with Markdown ): which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension) Developer Edition Version 8.9.6 (build 50800) what are you trying to achieve Our internal security team has found vulnerability with apache-commons-text library…

Hi, Please refer to this thread: [image] CVE-2022-42889 effect on SonarQube SonarQube Hi All, I want to know a small info on whether sonarqube version 9.3 & 9.5 has any affect with CVE-2022-42889 We have verified the source code on github, couldn’t see any library rela…

Hi, Could I only replace the file from commons-text-1.8.jar to commons-text-1.10.0.jar in /opt/sonarqube-9.6.1.59531/data/web/deploy/plugins/securityjavafrontend/META-INF/lib? I try it and SonarQube’s service startup successfully, any risk?

Hi @tsai_nat , Welcome to the community! As stated in the thread I referred to above, SonarQube versions aren’t vulnerable to this because it doesn’t use the dependency in a way that would expose it to the vulnerability. You should not be hacking your SonarQube instance. The risks are unknown b…

Hi, Thanks for the reply, I understand.

Hello, I understand that SonarQube is not vulnerable to CVE-2022-42889, but it is planned a new version with the last commons-text jar ? I’m using 8.9 LTS, and unfortunately our Global security team has stringent policy about vulnarabilities. They expect the software to use non-vulnerable files. T…

Hi @morris_monaco , You should consider upgrading to the latest version: 9.8. If you’re an LTS-only shop, then you’ll be pleased to know that 9.9 LTS will be released on 7 Feb. HTH, Ann

Hello Ann thank you for your tips. The version 9.8 or the next 9.9 LTS will solve the CVE-2022-42889 ? The commons-text jar is the last version ? I don’t understand why 8.9 LTS it’s not update with the last version of jar commons-text . Normaly LTS meaning that software was supported for issues a…

We just upgraded to the latest 9.8 version (EE) and Our enterprise vulnerability scans still pick up on CVE-2022-42889. In previous forum discussions it seems that this vulnerability does not affect sonarqube, but we have strict rules that vulnerable files cannot be used. It was also said ma…

Hello Jade, Thank you for reaching out. SQ 9.8 was shipped with commons-text 1.10.0, which patches CVE-2022-42889. Which scanner did you use? Can you provide more details about your finding (e.g. on what path(s) this vulnerability was found)? Thank you in advance.

Apache Commons-text library vulnerability

SonarQube Server / Community Build

ganncamp (G Ann Campbell) October 20, 2022, 5:30pm 2

Hi,

Please refer to this thread:

Ann

Topic		Replies	Views
CVE-2022-42889 effect on SonarQube SonarQube Server / Community Build security , cve	26	7279	November 18, 2022
Is CVE-2022-42889, AKA Text4Shell vulnerability impacting SonarQube SonarQube Server / Community Build security , cve	1	1623	October 21, 2022
Is there "official" sonarqube documentation that states version 9.9 is NOT impacted by CVE-2022-4288 SonarQube Server / Community Build	5	991	May 24, 2023
About the many CVE in sonar-plugin-api dependencies SonarQube Server / Community Build custom_rules , security	5	2240	February 8, 2022
Dependencies Vulnerabilities Sonarqube Community 9.9 SonarQube Server / Community Build sonarqube	1	329	February 16, 2024

Apache Commons-text library vulnerability

Related topics