sonarqube/25.6.0.109173-r0: cve remediation

[octo-sts]

sonarqube/25.6.0.109173-r0: fix GHSA-wxr5-93ph-8wr9

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/sonarqube.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

⚙️ Build Failed: Configuration

Error: failed to parse the pom file: open pom.xml: no such file or directory

Build Details

Category	Details
Build System	Maven
Failure Point	pombump pom.xml command in maven/pombump step

Root Cause Analysis 🔍

The build process expected to find a pom.xml file in the repository root directory, but the file was not found. This indicates a configuration mismatch - either the wrong directory is being used, the repository structure is different than expected, or the repository doesn't use Maven as its build system.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• cassandra-5.0/5.0.3-r0: cve remediation #42330
• selenium/4.28.0-r0: cve remediation #42311

Suggested Changes

File: sonarqube.yaml

• remove at line 44 (pipeline section)
  Original:

  - uses: maven/pombump

Click to expand fix analysis

Analysis

The pattern in similar fixed build failures shows that the error "failed to parse the pom file: open pom.xml: no such file or directory" occurs when the maven/pombump step is used on projects that either:

1. Don't use Maven as their build system (using Ant, Bazel, or in this case, Gradle)
2. Have pom.xml files located in non-standard locations

In both previous examples, the fix involved either:

• Specifying the correct path to the pom.xml file (Fix Example #0 for Cassandra)
• Adding a patch file that manually updates dependencies without relying on pombump (Fix Example Add binutils-2.39 configuration #1 for Selenium)

Looking at the sonarqube.yaml file, it's using Gradle for building ("./gradlew build") but still includes the maven/pombump step without specifying a pom.xml location.

Click to expand fix explanation

Explanation

The build is failing because the maven/pombump step is trying to find a pom.xml file in the root directory of the SonarQube repository, but SonarQube uses Gradle as its build system, not Maven. This is evident from the build command in the pipeline that uses Gradle: "./gradlew build -x test -DbuildNumber=${{vars.build-number}}".

While SonarQube might have some Maven pom.xml files in subdirectories for certain components, it's primarily a Gradle-based project, and the maven/pombump step is unnecessary for the build process. The step is attempting to parse and potentially modify Maven dependencies, but since the project doesn't have a pom.xml in the root directory where pombump is looking, the build fails.

Removing the maven/pombump step entirely will allow the build to proceed directly to the patching and Gradle build steps, which is the correct approach for this Gradle-based project. The Gradle build system will handle dependency management on its own without needing the Maven-specific pombump step.

Click to expand alternative approaches

Alternative Approaches

• If there are specific dependency updates needed, we could locate the pom.xml files within the project (if they exist in subdirectories) and specify the correct path in the maven/pombump step, similar to the Cassandra fix: '- uses: maven/pombump
  with:
  pom: ./path/to/pom.xml'
• Create a dependency patch file and use it with the patch step instead of using maven/pombump, similar to the Selenium fix where they created a 'bump-netty.patch' file to update dependencies
• If dependency updates are needed for security reasons, modify the Gradle build files directly with a patch to update specific dependencies

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-jg27-23w9-m7hp has the latest event type of "pending-upstream-fix": https://github.com/wolfi-dev/advisories/blob/main/sonarqube.advisories.yaml

ID:      CGA-jg27-23w9-m7hp
Package: sonarqube
Aliases: CVE-2025-48734 GHSA-wxr5-93ph-8wr9
Events:
  - "scan/v1" at 2025-06-18 17:16:38 UTC
  - "pending-upstream-fix" at 2025-06-19 06:05:06 UTC