chore(findings): sonarsource/sonarqube/sonarqube9-datacenter-search

Ghost User
2022-07-06T17:45:33Z

## Summary sonarsource/sonarqube/sonarqube has 33 new findings discovered during continuous monitoring. id | source | severity | package -- | ------ | -------- | ------- CVE-2018-10237 | twistlock_cve | Medium | com.google.guava_guava-19.0 CVE-2020-10517 | anchore_cve | Medium | github-api-1.93.0.71 CVE-2020-10518 | anchore_cve | High | github-api-1.93.0.71 CVE-2020-10519 | anchore_cve | High | github-api-1.93.0.71 CVE-2020-13697 | twistlock_cve | Medium | org.nanohttpd_nanohttpd-2.3.1 CVE-2020-8908 | twistlock_cve | Low | com.google.guava_guava-10.0.1 CVE-2020-8908 | twistlock_cve | Low | com.google.guava_guava-19.0 CVE-2021-22569 | twistlock_cve | High | com.google.protobuf_protobuf-java-3.15.8 CVE-2021-40690 | twistlock_cve | High | org.apache.santuario_xmlsec-2.1.4 CVE-2021-43797 | twistlock_cve | Medium | io.netty_netty-codec-http-4.1.66.Final CVE-2022-21230 | anchore_cve | Medium | nanohttpd-2.3.1 CVE-2022-24823 | twistlock_cve | Medium | io.netty_netty-codec-4.1.66.Final CVE-2022-24823 | twistlock_cve | Medium | io.netty_netty-codec-http-4.1.66.Final CVE-2022-25647 | twistlock_cve | High | com.google.code.gson_gson-2.8.6 GHSA-269q-hmxg-m83q | anchore_cve | Medium | netty-codec-http-4.1.66.Final GHSA-269q-hmxg-m83q | anchore_cve | Medium | netty-codec-http-4.1.66.Final GHSA-4jrv-ppp4-jm57 | anchore_cve | High | gson-2.8.6 GHSA-57j2-w4cx-62h2 | anchore_cve | High | jackson-databind-2.11.3 GHSA-5mg8-w23w-74h3 | anchore_cve | Low | guava-10.0.1 GHSA-5mg8-w23w-74h3 | anchore_cve | Low | guava-19.0 GHSA-7r82-7xv7-xcpj | anchore_cve | Medium | httpclient-4.5.10 GHSA-9vjp-v76f-g363 | anchore_cve | High | netty-codec-4.1.66.Final GHSA-fg2v-w576-w4v3 | anchore_cve | High | json-smart-1.3.2 GHSA-fg2v-w576-w4v3 | anchore_cve | High | json-smart-2.4.2 GHSA-grg4-wf29-r9vv | anchore_cve | High | netty-codec-4.1.66.Final GHSA-j8wc-gxx9-82hx | anchore_cve | High | xmlsec-2.1.4 GHSA-mvr2-9pj6-7w5j | anchore_cve | Medium | guava-19.0 GHSA-wx5j-54mm-rqqq | anchore_cve | Medium | netty-codec-http-4.1.66.Final PRISMA-2021-0213 | twistlock_cve | Medium | com.fasterxml.jackson.core_jackson-databind-2.11.3 CVE-2021-31684 | twistlock_cve | High | net.minidev_json-smart-1.3.2 CVE-2021-31684 | twistlock_cve | High | net.minidev_json-smart-2.4.2 CVE-2004-0542 | anchore_cve | High | php-checks-3.23.1.8766 CVE-2004-0542 | anchore_cve | High | php-frontend-3.23.1.8766 VAT: https://vat.dso.mil/vat/container/20040?branch=master
More information can be found in the failed pipeline located here: https://repo1.dso.mil/dsop/sonarsource/sonarqube/sonarqube9-datacenter-search/-/jobs/12270193 ## Tasks Contributor: - [x] Provide justifications for findings in the [VAT](https://vat.dso.mil) ([docs](https://repo1.dso.mil/dsop/dccscr/-/blob/master/pre-approval/vat.md)) - [x] Apply the ~"Approval" label to this issue and wait for feedback Iron Bank: - [ ] Review findings and justifications - [ ] Send approval request to Authorizing Official - [ ] Close issue after approval from Authorizing Official > Note: If the above approval process is rejected for any reason, the `Approval` label will be removed and the issue will be sent back to `Open`. Any comments will be listed in this issue for you to address. Once they have been addressed, you **must** re-add the `Approval` label. ## Questions? Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add `/cc @ironbank-notifications/onboarding`. Additionally, Iron Bank hosts an [AMA](https://www.zoomgov.com/meeting/register/vJIsf-ytpz8qHSN_JW8Hl9Qf0AZZXSCSmfo) working session every Wednesday from 1630-1730EST to answer questions.