Sonar scanner CLI vulnerability

[fed]

Hello, it seems the Scanner CLI has a vulnerability in one of the packages it uses.

Our Twistlock scan detects the following:
package com.squareup.okhttp3_okhttp_3.14.2 - fixed in 4.9.2

Using the latest version 4.7.0.2747 from GitHub - SonarSource/sonar-scanner-cli: Scanner CLI for SonarQube and SonarCloud

I don’t see a direct reference to that package in the source, do you know how it could be fixed?

Thanks

[Colin]

Hey there.

Take a look at this thread:

Sonar-scanner-cli and vulnerable okhttp3 dependency

Hello @pravorskyi, Welcome to the community and thank you to bringing this to our attention! After investigation, we consider ourselves not vulnerable as we encode in base64 the authorization header, hence avoiding passing illegal characters to the request. We however plan to upgrade to okhttp4 in the next versions to keep up to date.