What is the impact of Log4j on the SonarQube version 9.1.0.47736

[harshalkolhe]

Hello Team,

As we have the critical vulnerability reported for Log4j files, could you please confirm whether there is any impact on the version of SonarQube used by us.

We used version - 9.1.0.47736.

Please confirm on this.

[ganncamp (G Ann Campbell)]

Hi,

Please see this thread:

SonarQube, SonarCloud, and the Log4J vulnerability

Update 21 December 2021 Hi all, We’ve just released SonarQube 8.9.6 LTS and 9.2.4 (Latest) to eliminate confusion and avoid false-positive from vulnerability scanning tools in regards to: CVE-2021-45046, CVE-2021-44228 and CVE-2021-45105. In these new versions, the Elasticsearch component is updated to its latest bugfix version, 7.16.2, which updates the packaged Log4J dependency to 2.17. Note: Although our security researchers have not found the previous SonarQube LTS (8.9.3, 8.9.4 or 8.9.5…

 
Ann

[harshalkolhe]

Hi Ann,

This thread mentions about 9.2 and 8.9 versions we have 9.1, so 9.1 is also covered under this?
Kindly confirm.

Thanks,
Harshal

[felipebz (Felipe Zorzo)]

Note that the LTS and the Latest are the only two supported versions. All other versions are past EOL. Please update to one of the two supported versions as soon as you can.

You’re already running an unsupported version that may contain many other vulnerabilities. You must update to SonarQube 9.2.3.