CVE-2018-8292 alert in Github but not from SonarQube Scan

[Prasen (Prasenjit Choudhury)]

Hi ,

We have application source code in Github and CI pipeline integrated with SonarQube running via Azure Pipeline.

Now with Github native security feature we are seeing alert

However the same through Sonar Scanner is not coming as Security hotspot or vulnerability. Could you please explain why there is a mismatch I am experiencing.

[Hendrik_Buchwald]

Hi Prasenjit and welcome to the community!

GitHub is warning you about a vulnerability in a dependency, so-called Software Composition Analysis (SCA). At this time we are focussing on Static Application Security Testing (SAST) though and do not provide SCA.

[Rebse (Gilbert Rebhan)]

Welcome

if using Sonarqube on prem, you may try the community plugin (not supported by Sonarsource)

GitHub - dependency-check/dependency-check-sonar-plugin: Integrates...

Gilbert

[Prasen (Prasenjit Choudhury)]

@Hendrik_Buchwald

s warning you about a vulnerability in

Hi Hendrik ,

That makes sense now to me . Thanks for the help.

[Prasen (Prasenjit Choudhury)]

Hey Gilbert ,

Yes , we have SonarQube on prem . I will check that . Thanks .