Sonarqube 10.4.1 / Security Issue CVE-2024-22243

SonarQube Server / Community Build
1

Hi,

Sonarqube is affected by Spring “Framework Open Redirect Vulnerability” (CVE - CVE-2024-22243). Please quickly update the Spring Framework to 5.3.33 or higher

This vulnerable jar come with 10.4.1:
$ find . -name “spring*”
…
./web/deploy/plugins/securityjavafrontend/META-INF/lib/spring-core-5.3.28.jar
…

2

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com!

Thanks!

4

The CVE is official already??? Don’t you have securtiy scans for your software???