Which SonarQube Community Version mitigates CVE-2024-34750

[Zin]

Hi all,

We are using SonarQube CE 9.9.4. As we know that SonarQube is using embedded Apache Tomcat and there is a vulnerability which affects Apache Tomcat 9.0.89 and below (CVE-2024-34750). We have checked for version 10.6, the version for Apache Tomcat is at 9.0.87.

1. We would like to know which CE version will mitigate the CVE mentioned and when will it be released.
2. This is more on the security side, what is the hashing algorithm that SonarQube is using to hash the stored password in database. (Example: local accounts password)

Thanks in advance!

[Colin]

Hey there.

SonarQube isn’t not vulnerable to this CVE because we don’t use HTTP2.

As a matter of regular dependency updates, SonarQube v10.7 (this Fall) will package a newer version of Tomcat (at least 9.0.90).

[Zin]

Hi Colin,

Thank you so much for the response, looking forward forward to v10.7.

There is another question regarding about the hashing algorithm used for password stored in the database. There is a IM8 requirement and we have to comply to that for all our application used. By any chance you have an answer for this too?

Thank you.

[Colin]

The hashing algorithm is PBKDF2WithHmacSHA512, but I don’t know anything about IM8 and whether or not that complies. Hope that helps!

[Zin]

Thanks Colin, that really help as we are trying to find the documentations!

Also you mentioned that SonarQube is not using HTTP2, is there any interim solution we can put in place to mitigate the CVE till the new version release in fall?

[Colin]

The CVE is mitigated, because SonarQube doesn’t use HTTP/2 (the vulnerable part of Tomcat is not used by SonarQube). It’s not possible to independently update this dependency.

[Zin]

Understood, Thank you Colin!