June 2021 Summaries

SonarQube offers a range of features built on top of its developer-first foundations to help enterprises set up and manage user authentication (AUTHN) & user authorization (AUTHZ) in their existing environments, seamlessly integrating with identity provider solutions already in use at a company level. The platform supports LDAP and Active Directory integration for centralized authentication, as well as just-in-time provisioning, auto-synchronization of name and email via LDAP, support for multiple LDAP servers and security protocols, SSO with SonarQube, and delegation of authorization via groups, including Role Based Access Control (RBAC). These features enable enterprises to centralize their user management and ensure consistency of user information across their IT setup.

This paragraph provides a neutral summary of the text, highlighting key points about the vulnerabilities found in CiviCRM version 5.22.0. The vulnerabilities were discovered during vulnerability research and resulted in a combination that could allow remote attackers to execute arbitrary system commands on any CiviCRM instance running on WordPress, compromising the server and its data. The vulnerabilities, including CSRF and Phar Deserialization issues, were reported responsibly to the vendor, who released multiple security patches to protect users against attacks. The patched versions of CiviCRM are 5.28.1 and 5.27.5 ESR for the CSRF vulnerability, and 5.24.3 and 5.21.3 for the Phar Deserialization issue. It is recommended that users hosting a CiviCRM instance update their installation to the latest patched version to ensure security.

** SonarQube v8.9 LTS has been released, offering a significant amount of work and improvements over its predecessor, including new features such as automatic configuration for Jenkins branches and pull requests, customizable Quality Gate conditions, provisioned projects on first analysis, support for new language versions, improved DevOps platform connectivity, enhanced Compute Engine performance, and color-blind friendly coverage indicators. These changes aim to simplify the upgrade process and enhance user experience, making it easier for teams to analyze code quality and improve their development processes.

With SonarQube 8.9 LTS, SonarSource has made it available for everyone to fail a pipeline when the Quality Gate fails, using any CI desired. This feature was initially introduced as a plugin in 2013 but was deprecated and then maintained by the community. The company recognized the demand for this feature despite its limitations, including increased load on instances and potential pipeline duration increases. The `sonar.qualitygate.wait` parameter is now available, but it has drawbacks such as polling the SonarQube instance and potentially increasing pipeline duration.

The Grav CMS, a modern web platform built on Twig, Symfony, and Doctrine, has been found vulnerable to two significant security issues, CVE-2021-29440 and CVE-2021-29439, which can be exploited by authenticated attackers with low privileges. The vulnerabilities were discovered in the administration dashboard and core of the CMS, allowing remote attackers to execute arbitrary PHP code and system commands on the underlying server. The maintainers have since released patches for both issues, addressing the security concerns and ensuring the stability of the platform. The discovery highlights the importance of regular security research and testing, as well as the need for users to keep their instances up-to-date with the latest version.