# Log4j 2 security issue **URL:** \ **Category:** SonarQube Server / Community Build\ **Created:** [December 10, 2021, 9:51am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676 "2021-12-10T09:51:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MikeN](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/miken/32/3846_2.png) [@MikeN](https://community.sonarsource.com/u/MikeN)\ **Post date:** [December 10, 2021, 9:51am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/1 "2021-12-10T09:51:28Z")
The latest SonarQube seems to include log4j 2 as Elasticsearch dependency. A pretty bad RCE has been found in log4j 2, see [Log4Shell: RCE 0-day exploit found in log4j, a popular Java logging package | LunaSec](https://www.lunasec.io/docs/blog/log4j-zero-day/) and it is likely this could be exploited in some way through SonarQube. I was wondering if and when patches will be available? I would have asked this through some kind of private channel, but Sonar does not provide any support not can security contacts be found anywhere (which is quite a bad security posture for an organisation developing a SAST, tbh). ---
**Author:** ![Tobias\_Trabelsi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/tobias_trabelsi/32/31755_2.png) [@Tobias\_Trabelsi](https://community.sonarsource.com/u/Tobias_Trabelsi)\ **Post date:** [December 10, 2021, 10:01am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/2 "2021-12-10T10:01:07Z")
---
**Author:** ![Tobias\_Trabelsi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/tobias_trabelsi/32/31755_2.png) [@Tobias\_Trabelsi](https://community.sonarsource.com/u/Tobias_Trabelsi)\ **Post date:** [December 10, 2021, 10:03am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/3 "2021-12-10T10:03:38Z")
Hi @MikeN , we are aware of this report and are currently evaluating the impact of this finding. in regards of your other question: we have a responsible [disclosure guide here](https://community.sonarsource.com/t/responsible-vulnerability-disclosure/9317), which would be the correct way to report this finding. I have unlisted your post until we are done with the evaluation. after that i will relist this thread with a update message ---
**Author:** ![MikeN](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/miken/32/3846_2.png) [@MikeN](https://community.sonarsource.com/u/MikeN)\ **Post date:** [December 10, 2021, 10:06am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/4 "2021-12-10T10:06:11Z")
Thanks. I failed to check the well-known location, and a community post for your responsible disclosure guide is basically unfindable through Google. I would really suggest to also include a link somewhere on your website, like on [Contact | SonarSource](https://www.sonarsource.com/company/contact/) as that is where people will be looking if they want ot contact you regarding something. ---
**Author:** ![Tobias\_Trabelsi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/tobias_trabelsi/32/31755_2.png) [@Tobias\_Trabelsi](https://community.sonarsource.com/u/Tobias_Trabelsi)\ **Post date:** [December 13, 2021, 7:23am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/5 "2021-12-13T07:23:38Z")
Hi @MikeN , we published a statement regarding this log4j vulnerability here: [SonarQube and the Log4J vulnerability](https://community.sonarsource.com/t/sonarqube-and-the-log4j-vulnerability/54721) with that i am relisting this thread. ---
**Author:** ![Tobias\_Trabelsi](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/tobias_trabelsi/32/31755_2.png) [@Tobias\_Trabelsi](https://community.sonarsource.com/u/Tobias_Trabelsi)\ **Post date:** [December 13, 2021, 7:23am UTC](https://community.sonarsource.com/t/log4j-2-security-issue/54676/6 "2021-12-13T07:23:44Z")