Different Docker images for SonarQube on Docker Hub

[alexmsu (Alexander)]

Hello,

At Sonar we have different docker images: community, developer and enterprise. Also, these images we have in Docker Hub: Docker Hub

Some of the images are checked and contain security vulnerabilities, some do not.
In this case one question: Is the latest Docker Hub image developer or community or enterprise version?

Thanks.
Alexander.

[Colin]

Hey there.

sonarqube:latest represents Community Edition (it’s the same image as sonarqube:community).

No supported version of SonarQube is vulnerable to Text4Shell. Read more here:

CVE-2022-42889 effect on SonarQube

Hey all. SonarQube is not vulnerable to CVE-2022-42889–neither v8.9.10 LTS or v9.7. org.apache.commons.text.StringSubstitutor, the use of which can lead to a vulnerability, is not used in either version. We will in any case update the dependency version (or try to drop it entirely) in future SonarQube versions (starting with v9.8) to suppress the warning. There are no plans at the moment to update v8.9 LTS. We will keep you posted if anything changes.