Thymeleaf vulnerability impact?

SonarQube Server / Community Build
1

Our security scanner is picking up thymeleaf-3.0.14.RELEASE located within sonar-security-java-frontend-plugin-9.9.0.19083.jar in our sonarqube server installation as vulnerable to CVE-2023-38286.

My questions are:

  1. Is sonarqube server impacted by this CVE?
  2. Are there plans to update thymeleaf in future LTA releases of sonarqube server? If so is there an estimate of when the update would be released?
  3. Is it possible to patch sonar-security-java-frontend-plugin directly? Is there already a newer version that contains an updated thymeleaf that I can install?

File location: /opt/sonarqube/lib/extensions/sonar-security-java-frontend-plugin-9.9.0.19083.jar:META-INF/lib/thymeleaf-3.0.14.RELEASE.jar

Must-share information:

  • which versions are you using: SonarQube Server Enterprise 9.9.8.100196
  • how is SonarQube deployed: installed from zip into a docker image
  • what are you trying to achieve: determine impact of potential vulnerability
  • what have you tried so far to achieve this: N/A
2

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com?

Thanks!

1 Like