Elstic Search Log4j

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

I guess you didn’t get around to searching. When I search (top-right corner) for “Log4J” the first result is our official statements made at the time the vulnerability was discovered:

SonarQube, SonarCloud, and the Log4J vulnerability

Update 21 December 2021 Hi all, We’ve just released SonarQube 8.9.6 LTS and 9.2.4 (Latest) to eliminate confusion and avoid false-positive from vulnerability scanning tools in regards to: CVE-2021-45046, CVE-2021-44228 and CVE-2021-45105. In these new versions, the Elasticsearch component is updated to its latest bugfix version, 7.16.2, which updates the packaged Log4J dependency to 2.17. Note: Although our security researchers have not found the previous SonarQube LTS (8.9.3, 8.9.4 or 8.9.5…

 
HTH,
Ann