Is there "official" sonarqube documentation that states version 9.9 is NOT impacted by CVE-2022-4288

[Colin]

And you’re sure that it’s SonarQube 9.9 LTS being scanned, not the intermediary SoanrQube 8.9 LTS you’re upgrading to? Any details you can provide from that scan, like where it’s finding the dependency, would be super helpful.

We don’t have anything in our documentation that speaks to specific CVEs. You’ll have to rely on statements from SonarSourcers such as:

CVE-2022-42889 effect on SonarQube

Hello Sandy7894,Maarten, Thank you for reaching out to us; we take all customer vulnerability reports very seriously. None of these SonarQube versions are vulnerable to CVE-2022-42889. However, SQ 9.3 and 9.5 are no longer supported; hence our advice is to update to the last release, 9.7, which of course, is not vulnerable either. Please let me know if you have any further questions. Kind regards, Emanuele

CVE-2022-42889 effect on SonarQube

Hey all. SonarQube is not vulnerable to CVE-2022-42889–neither v8.9.10 LTS or v9.7. org.apache.commons.text.StringSubstitutor, the use of which can lead to a vulnerability, is not used in either version. We will in any case update the dependency version (or try to drop it entirely) in future SonarQube versions (starting with v9.8) to suppress the warning. There are no plans at the moment to update v8.9 LTS. We will keep you posted if anything changes.