Cve-2023-4863 - open-source libwebp library

[jperez (juan perez)]

• Community Edition
• Version 9.9.2 (build 77730)

Just info if Sonarqube is affected by the last vulnerability discovered in open-source libwebp library

Thanks in advance

Juan

[Rebse (Gilbert Rebhan)]

Hi,

did a search yesterday and could not find any reference to libwebp neither in Sonarqube 9.9 LTS / 10.2
nor in Apache httpd (used as reverse proxy).

Otherwise i had findings, i.e. in IntelliJ 2023.2

…\IntelliJIDEA\plugins\webp\lib\webp.jar
…\IntelliJIDEA\plugins\webp\lib\libwebp\win\webp_jni.dll
…\IntelliJIDEA\plugins\webp\lib\libwebp\win\webp_jni64.dll

Gilbert

[Colin]

See our announcement here:

Sonar and libwebp

Hey there. We wanted to proactively address the newly reported libwebp vulnerabilities (CVE-2023-4863 and CVE-2023-5129) – our research has so far indicated that none of our products are impacted. While NIST has deemed CVE-2023-5129 as a duplicate of CVE-2023-4863, we will continue to monitor the situation for both. We will provide additional updates in this thread, should the impact change.