Search code examples
nexussonatype

avoiding Nexus critical security vulnerabilities

I am using Nexus version 2.10.0-02 and I got "Caution Nexus Administrators" bloc when I log in as an admin. This bloc contains the 3 famous security vulnerabilities CVE-2014-9389, CVE-2014-2034 and CVE-2014-0792.

To avoid the first vulnerability, I upgraded nexus to the latest release 2.11.1-01, but, the problem persists.

For the second and the third one, I don't know if they are fixed or not. In fact, does the warning disappear from the admin dashboard if the problem is fixed?

Would someone, please, tell me what to do to fix these issues?

Solution

  • All of the CVE's you referenced are fixed in Nexus 2.11.1-01.

    Nexus currently isn't able to filter the welcome message by point release (2.11.x), so it will remain visible even though you are now patched. You can safely ignore it now.