Can a Sonar Source representative please post/link an explanation of the extent to which various versions of SonarQube are affected by this CVE and what (if any) actions are recommended?
Thank you!
Hi,
I’ve unlisted your topic since you’re enquiring about a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com!
Thx,
Ann
Will-do, big thanks!
1 Like
Looks like we’re all good on this:
Official guidance recieved from Sonar Source - No action needed on our end
From security@sonarsource.com:
Dear Brandon,
Thank you for contacting Sonar to inquire about this vulnerability.
We can confirm that no version of SonarQube uses the polyfill library and is, therefore, not vulnerable.
1 Like
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.