Is Sonarqube affected by CVE-2022-1471 and CVE-2024-1597?

SonarQube Server / Community Build
,
1

Must-share information

  • which versions are you using
    sonarqube 9.9.3.79811 and postgres15
  • how is SonarQube deployed: zip, Docker, Helm
    zip

Hi experts,

Two severity vulnerabilities CVE-2022-1471( SnakeYAML library for Java) and CVE-2024-1597(PostgreSQL JDBC Driver) was detected in our locally deployed sonarqube instance by a third party tool.

My questions are:

  1. Is Sonarqube affected by CVE-2022-1471 and CVE-2024-1597?
  2. If yes, do you have any suggestions to deal with these two vulnerabilities ?
2

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com!

Thanks!