Disable ElasticSearch Attachment Processor within SonarQube

akula.vamshee · June 12, 2024, 10:51am

Our instance of SonarQube was flagged as having an out-of-date Elasticsearch version (8.11.0) that contains security vulnerabilities. We must upgrade the ElasticSearch version (8.11.0) to (8.11.1). Due to external factors related to internal automation software, we cannot upgrade the SonarQube version now. As per the community’s response, it is impossible to upgrade ElasticSearch alone.
Question here is can we disable the attachment processor in ElasticSearch within the Sonarqube using the below config in sonar-conf.properties? If yes, do we have any impacts on SQ working? Please suggest.

Config to disable ES attachment processor within SQ:

Disable Elasticsearch attachment processor

sonar.search.javaAdditionalOpts=-Dsonar.search.javaAdditionalOpts=-Dsonar.search.elasticsearch.nodesIngest=0

I am referring to ElasticSearch Security Update documentation - Elasticsearch 8.11.1 Security Update (ESA-2024-05) - Security Announcements - Discuss the Elastic Stack

felipebz · June 12, 2024, 11:20am

Hi,

I believe SonarQube distribution doesn’t even include the ElasticSearch attachment processor module.

github.com

SonarSource/sonarqube/blob/280536afae9e8f8ffc27ba6640e23bbdd12b91da/sonar-application/build.gradle#L187


      
          exclude '**/jdk/**'
          exclude '**/lib/tools/ansi-console'
          exclude '**/lib/tools/geoip-cli'
          exclude '**/lib/tools/plugin-cli'
          exclude '**/modules/aggs-matrix-stats/**'
          exclude '**/modules/blob-cache/**'
          exclude '**/modules/constant-keyword/**'
          exclude '**/modules/data-streams/**'
          exclude '**/modules/frozen-indices/**'
          exclude '**/modules/inference/**'
          exclude '**/modules/ingest-attachment/**'
          exclude '**/modules/ingest-common/**'
          exclude '**/modules/ingest-geoip/**'
          exclude '**/modules/ingest-user-agent/**'
          exclude '**/modules/kibana/**'
          exclude '**/modules/lang-expression/**'
          exclude '**/modules/lang-mustache/**'
          exclude '**/modules/legacy-geo/**'
          exclude '**/modules/mapper-extras/**'
          exclude '**/modules/mapper-version/**'
          exclude '**/modules/ml-package-loader/**'

Topic		Replies	Views
Possible to upgrade ElasticSearch version inside SonarQube Developer Edition 10.3.0.82913 SonarQube Server / Community Build sonarqube	3	277	June 14, 2024
Possible to upgrade ElasticSearch version inside SonarQube Comm Ed 6.7.1 SonarQube Server / Community Build sonarqube	1	593	March 27, 2020
ElasticSearch problem after rolling back an upgrade SonarQube Server / Community Build	4	1574	February 8, 2023
Upgrade SonarQube from v8.2-community to latest v9.8-community SonarQube Server / Community Build sonarqube	4	398	January 23, 2023
Elasticsearch integration SonarQube Server / Community Build	3	924	December 16, 2021

Disable ElasticSearch Attachment Processor within SonarQube

Disable Elasticsearch attachment processor

Related topics