doc(sonarqube): GHSA-m494-w24q-6f7w

[catmsred]

False positive due to mssql-jdbc versioning structure similar to
#25255

Relates: https://github.com/chainguard-dev/CVE-Dashboard/issues/35920

[jamie-albert]

For false positives I need more info in the PR body to prove the investigation chain like:

1. dependency fix version
   • https://github.com/advisories/GHSA-m494-w24q-6f7w#:~:text=12.10.2.jre11-,13.2.1.jre11,-Description
2. fix commit exists in tagged version:
   • SonarSource/sonarqube@ad60346
3. Which matches the version in wolfi main
   • https://github.com/jamie-albert/os/blob/8c2d24e60bf35cb3ba15890214f35edc5d6c01f9/sonarqube.yaml#L3
4. verified by dependency version detected as seen in the advisory file

   • advisories/sonarqube.advisories.yaml

     Line 442 in 671024d

     componentLocation: /usr/share/sonarqube/lib/jdbc/mssql/mssql-jdbc-13.2.1.jre11.jar

[jamie-albert]

You can not use this here directly like this

False positive due to mssql-jdbc versioning structure similar to
#25255

because that PR has evidence in it for keycloak. This is sonarqube.

The cve scan result in the issue comments is not enough evidence alone to claim a false positive.