Update 21 December 2021 Hi all, We’ve just released SonarQube 8.9.6 LTS and 9.2.4 (Latest) to eliminate confusion and avoid false-positive from vulnerability scanning tools in regards to: CVE-2021-45046 , CVE-2021-44228 and CVE-2021-45105 . In these new versions, the Elasticsearch component is upda…

Hi All On latest 9.2.3 Developer edition we are still seeing log4j 2.11.1 old version.

Hello, what about SonarQube version 9.1? Do I need to upgrade it to 9.2 or downgrade it back to 8.9.3? Dennis…

Do you mean log4j-api-2.11.1? That one is safe (so far). It is only log4j-core that contains the vulnerable class.

I was referring to all the discussion about “[CVE-2021-45046, [CVE-2021-44228 ], and CVE-2021-44228”. All the discussion states 8.9 and 9.2 are okay, but no mention about 9.1

There’s no mention to it because it’s not supported. :wink: The only supported versions are LTS (8.9.x) and the latest 9.2 release.

Hi, Do you have more info about the CVE-2021-44832 vulnerability? CVE-2021-44832: A Medium Severity Was Found in Log4j so upgrade to log4j 2.17.1? thanks Vincent

Not a sonarsource employee, but: In order to exploit CVE-2021-44832 you already have to have a bad actor on your network and/or your server with the configuration file is badly configured. You will have way worse things to worry about and mitigate than this theoretical exploit (aka your network is…

flagging vulneraibility of file elasticsearch-sql-cli-7.12.1.jar (CVE-2021-44228 ) Hello Sonar team, I updated the core and api log4j jars for new versions but now I am getting flagged because another possible “vulnerable” file exists in the Sonarqube repository: sonarqube-8.9.1\elasticsearch\bin\…

Hi @ivette07mar , Rather than butchering your current SonarQube install, your quickest way to address those vulnerabilities is to upgrade to 8.9.6 LTS where this is fixed. This version has no new functionality compared to yours, only security fixes, so an update should have no side effects that you…

Hello, Any tentative date for new release which will have log4j 2.17.1 version. Thanks, Gajanan

SonarQube, SonarCloud, and the Log4J vulnerability

Sonar Updates

Topic		Replies	Views
SonarQube 8.9.5 LTS and 9.2.3 released Releases sonarqube	0	4069	December 16, 2021
SonarQube 8.9.6 LTS and 9.2.4 released Releases sonarqube	0	8593	December 21, 2021
What is the impact of Log4j on the SonarQube version 9.1.0.47736 SonarQube Server / Community Build	3	1314	December 17, 2021
SonarQube 8.9.4 LTS and 9.2.2 released Releases sonarqube	6	6276	December 15, 2021
Elstic Search Log4j SonarQube Server / Community Build sonarqube , scanner	1	859	July 15, 2022

SonarQube, SonarCloud, and the Log4J vulnerability

Related topics