SonarQube, SonarCloud, and the Log4J vulnerability

Sonar Updates
93

Hi all,

We’ve just released SonarQube 8.9.5 LTS and 9.2.3 (Latest) to address CVE-2021-45046. In these new versions:

  • The SonarQube Log4J test dependency is updated to 2.16. This dependency is not used outside of unit testing, nor is it included in the SonarQube distribution. It is not susceptible to the CVEs being reported. Nonetheless, we have upgraded it to eliminate confusion.
  • The Elasticsearch component is updated to its latest bug fix version, 7.16.1, which removes the potentially problematic components of Log4J. Additionally, it should be noted that SonarQube programmatically adds the log4j2.formatMsgNoLookups=true JVM property on starting up Elasticsearch.
    More explanations from Elasticsearch here.

Note that the LTS and the Latest are the only two supported versions. All other versions are past EOL. Please update to one of the two supported versions as soon as you can.

 
Ann

6 Likes