SONATYPE NEXUS REPOSITORY | VERSIONS 3.68.0 AND PRIOR
Critical Vulnerability Detected in Your Nexus Repository Version
Action Required: Nexus Repository Versions 3.68.0 and Prior Have a Critical Vulnerability That Requires Immediate Patching
Upgrade to Mitigate Your Risk
This deployment is using an older Nexus Repository version that contains multiple exploitable critical security vulnerabilities that allow attackers to access sensitive files outside the application scope. We recommend upgrading to the latest version immediately to resolve CVE-2024-4956 and CVE-2024-5764.
CVE-2024-4956
This path traversal vulnerability enables an attacker to create a URL that can return a file as a download without authentication.
Fixed in Nexus Repository Version 3.68.1
CVE-2024-5764
The vulnerability exists in code responsible for encrypting secrets stored in the configuration database.
Fixed in Nexus Repository Version 3.73.0
Your version of Nexus Repository may be sunset and no longer supported. Please refer to Sonatype's version status on when your version will be sunset.
Before upgrading to a new version, you may need to update your database. If your deployment uses OrientDB, please be aware that it has been deprecated due to observed data integrity issues in some configurations. Sonatype recommends transitioning to a supported database solution. More information can be found in our upgrade documentation.
Take Advantage of New Capabilities in Sonatype Nexus Repository
Feature |
Capabilities |
Benefits |
|---|---|---|
| Ecosystem & Format Support |
|
Simplify artifact management with wider language and repo coverage to increase developer productivity and support platform consolidation.
|
| High Availability (HA) & Zero-Downtime |
|
Avoid downtime with true enterprise-grade HA. Align with cloud-native ops that frees SRE hours.
|
| Java 17 & Database Upgrades |
|
Future-proof JVM/runtime for performance/stability via modern DB layer and expect fewer CVEs and patch cycles with faster I/O to accelerate pipelines.
|
| Credential & Identity Security |
|
Reduce breach risk and identity errors with token lifecycle governance, safer credential storage, and IdP agility that automates user lifecycle transitions.
|
| Automation via REST APIs |
|
Take full control of operations via script/API to reduce admin overhead, and enable DevSecOps compliance-as-a-code to be CI-ready.
|
| Cloud Blob-Store Flexibility |
|
Enable secure, scalable link-based artifact delivery and geo-distributed storage support with cost-effective cloud architecture and disaster recovery (DR).
|
| Security Monitoring & Firewall |
|
Block exploit vectors early with threat visibility, automated protections, and integration with your security stack to minimize MTTR and audit risk.
|
| Usage Analytics & Modern UI |
|
Reduce user friction and training effort with operational transparency and better UX for reporting and cleanup that helps align usage to cost.
|
| Platform Modernization |
|
Reduce upgrade and patch complexity with a cloud-native, simplified deployment, and promote easier container ops and image builds with faster start-up.
|
| Stability, Fixes, and Readiness |
|
Stability for edge cases and readiness for future platform changes that help ensure smoother upgrades, improving the developer experience.
|
Capabilities
| Feature | |
|---|---|
| Ecosystem & Format Support |
|
| High Availability (HA) & Zero-Downtime |
|
| Java 17 & Database Upgrades |
|
| Credential & Identity Security |
|
| Automation via REST APIs |
|
| Cloud Blob-Store Flexibility |
|
| Security Monitoring & Firewall |
|
| Usage Analytics & Modern UI |
|
| Platform Modernization |
|
| Stability, Fixes, and Readiness |
|
Benefits
| Feature | |
|---|---|
| Ecosystem & Format Support |
Simplify artifact management with wider language and repo coverage to increase developer productivity and support platform consolidation.
|
| High Availability (HA) & Zero-Downtime |
Avoid downtime with true enterprise-grade HA. Align with cloud-native ops that frees SRE hours.
|
| Java 17 & Database Upgrades |
Future-proof JVM/runtime for performance/stability via modern DB layer and expect fewer CVEs and patch cycles with faster I/O to accelerate pipelines.
|
| Credential & Identity Security |
Reduce breach risk and identity errors with token lifecycle governance, safer credential storage, and IdP agility that automates user lifecycle transitions.
|
| Automation via REST APIs |
Take full control of operations via script/API to reduce admin overhead, and enable DevSecOps compliance-as-a-code to be CI-ready.
|
| Cloud Blob-Store Flexibility |
Enable secure, scalable link-based artifact delivery and geo-distributed storage support with cost-effective cloud architecture and disaster recovery (DR).
|
| Security Monitoring & Firewall |
Block exploit vectors early with threat visibility, automated protections, and integration with your security stack to minimize MTTR and audit risk.
|
| Usage Analytics & Modern UI |
Reduce user friction and training effort with operational transparency and better UX for reporting and cleanup that helps align usage to cost.
|
| Platform Modernization |
Reduce upgrade and patch complexity with a cloud-native, simplified deployment, and promote easier container ops and image builds with faster start-up.
|
| Stability, Fixes, and Readiness |
Stability for edge cases and readiness for future platform changes that help ensure smoother upgrades, improving the developer experience.
|
Take Action to Protect Your Repository
Address the vulnerabilities in your repository instance and take advantage of ongoing enhancements by upgrading to the latest version of Nexus Repository. Review our upgrade instructions for more information. Questions or concerns about upgrading? Drop by our Community Forum to connect with other users and get answers from our team.
Upgrade to the latest version
On a Different Release?
Explore documentation for your existing release.