Sonarqube 8.6.x - Log4j vulnerability

SonarQube Server / Community Build
, ,
1

Hi Team,

With regards to recent events with globally reported Log4j vulnerability (CVE-2021-45046 and CVE-2021-44228).

We are currently using Sonarqube DE 8.6.1.40680. And it has the following two plugins with log4j.

  1. Elastic search
    sonarqube-developer-8.6.1.40680/sonarqube-8.6.1.40680/elasticsearch/config/log4j2.properties
    sonarqube-developer-8.6.1.40680/sonarqube-8.6.1.40680/elasticsearch/lib/log4j-api-2.11.1.jar
    sonarqube-developer-8.6.1.40680/sonarqube-8.6.1.40680/elasticsearch/lib/log4j-core-2.11.1.jar

  2. Sonarqube unit tests
    sonarqube-developer-8.6.1.40680/sonarqube-8.6.1.40680/lib/common/log4j-api-2.8.2.jar
    sonarqube-developer-8.6.1.40680/sonarqube-8.6.1.40680/lib/common/log4j-to-slf4j-2.8.2.jar

Can you please provide details on the impacts to 8.6.x?

Should we upgrade this to the latest version or any mitigation available for this?

Regards,
Deva

2

Hi @Devendran and welcome to the community :wave:

you can follow this thread for more information about the current log4j CVE and SonarQube.
Your version is EOL tho. The current supported versions of SonarQube are 8.9.x and 9.2

hope that helps :slight_smile:

1 Like