diff --git a/Dockerfile b/Dockerfile index ffad2e3..19feccc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ FROM sonarqube:8-community MAINTAINER Erik Jacobs MAINTAINER Siamak Sadeghianfar MAINTAINER Roland Stens (roland.stens@gmail.com) -MAINTAINER Wade Barnes (wade.barnes@shaw.ca) +MAINTAINER Wade Barnes (wade@neoterictech.ca) MAINTAINER Emiliano Sune (emiliano.sune@gmail.com) MAINTAINER Alejandro Sanchez (emailforasr@gmail.com) @@ -21,6 +21,14 @@ LABEL summary="$SUMMARY" \ # Define Plug-in Versions ARG SONAR_ZAP_PLUGIN_VERSION=1.2.0 ENV SONARQUBE_PLUGIN_DIR="$SONARQUBE_HOME/extensions/plugins" +# =============================================================================================== +# Mitigation for CVE-2021-44228 +# +# References: +# - https://logging.apache.org/log4j/2.x/security.html +# ----------------------------------------------------------------------------------------------- +ENV LOG4J_FORMAT_MSG_NO_LOOKUPS=true +# =============================================================================================== # Switch to root for package installs USER 0 diff --git a/sonarqube-postgresql-template.yaml b/sonarqube-postgresql-template.yaml index c5bf0cd..561d581 100644 --- a/sonarqube-postgresql-template.yaml +++ b/sonarqube-postgresql-template.yaml @@ -200,6 +200,8 @@ objects: value: sonar - name: SONAR_FORCEAUTHENTICATION value: "true" + - name: LOG4J_FORMAT_MSG_NO_LOOKUPS + value: "true" volumeMounts: - mountPath: /opt/sonarqube/data name: sonar-data