Update 21 December 2021 Hi all, We’ve just released SonarQube 8.9.6 LTS and 9.2.4 (Latest) to eliminate confusion and avoid false-positive from vulnerability scanning tools in regards to: CVE-2021-45046 , CVE-2021-44228 and CVE-2021-45105 . In these new versions, the Elasticsearch component is upda…

Thanks Gilbert, just wondering if Log 4J would be patched to version 2.17.1 (even though it is not a major fix) in LTS version 8.9.7, but we’ll go with the latest LTS version anyway (always a sure bet). Thanks for the quick reply 1 Jeff

Hi Jeff, if you really want a Sonarqube version with elasticsearch using log4j-core 2.17.1, you’ll have to go with the latest version Sonarqube 9.3.0 The release notes for Sonarqube 9.3.0 have: https://jira.sonarsource.com/browse/SONAR-15853 " Update of Elasticsearch to 7.16.2, update of Log4J …

Hi, SonarQube 9.3 effectively ships Elasticsearch 7.16.3. The corresponding ticket is the following one: SONAR-15869 . You can find several tickets related to the upgrade of Elasticsearch in SonarQube 9.3 release notes because the upgrade to Elasticsearch has been done iteratively in parallel to th…

Yes, overlooked that in the crowd of tickets related to log4j, sorry. Gilbert

Since version 9.3.0 is not in the LTS branch, would you say it is less stable ? We have installed version 8.9.7 for now. I saw that the plugins folder was empty. From the Web Admin console, i went to the Marketplace to search for Plugins. I aslo seached on the Internet on the SonarQube plugins i…

[image] jf2009: But for most of them, it says compatible wth 7.9 to 8.2 (like SonarVB, SonarXML, SonarCSS, etc.). Can i use the with version 8.9.7 ? The official plugins are now bundled with SonarQube, you don’t need to install them manually. Please read this: SonarQube v8.5 and Beyond: Wher…

Thanks Felipe, spot on ! I probably missed this important information but now i am relieved. I was checking the plugins because the developers who are testing SQ LTS 8.9.7 used the same build to compare version 8.0 and 8.9.7 and they sent me an image of the results and we can see that the number o…

I forgot to add that i did not installed the Sonar Scanner MSBuild for .NET Core and this project is built in .NET Core…maybe worth noting…i wasn’t sure if i had to install this Scanner and the other one for .NET Framework.

Hi Jeff, You’ll need to analyze with the SonarScanner for .NET to get correct results for .NET code. Ann

Thanks Ann, i will install these two scanners. I didn’t konw if there was something built in Sonarqube since 8.5 for .NET, since the plugins folder is empty and all the plugins have been integrated in the software. Jeff

SonarQube, SonarCloud, and the Log4J vulnerability

Sonar Updates

felipebz (Felipe Zorzo) February 11, 2022, 4:07pm 149

The official plugins are now bundled with SonarQube, you don’t need to install them manually. Please read this: SonarQube v8.5 and Beyond: Where did all the plugins go?

Topic		Replies	Views
SonarQube 8.9.5 LTS and 9.2.3 released Releases sonarqube	0	4067	December 16, 2021
SonarQube 8.9.6 LTS and 9.2.4 released Releases sonarqube	0	8583	December 21, 2021
What is the impact of Log4j on the SonarQube version 9.1.0.47736 SonarQube Server / Community Build	3	1309	December 17, 2021
SonarQube 8.9.4 LTS and 9.2.2 released Releases sonarqube	6	6268	December 15, 2021
Elstic Search Log4j SonarQube Server / Community Build sonarqube , scanner	1	857	July 15, 2022

SonarQube, SonarCloud, and the Log4J vulnerability

Related topics