Sonatype Nexus Repository 3.91.0 Vulnerability Fixes Summary

Sonatype Nexus Repository 3.91.0 Vulnerability and Remediation Summary Vulnerability Overview Sonatype Nexus Repository version 3.91.0 primarily addresses functional defects, metadata cache errors, garbage collection issues, and concurrency and stability problems in high-availability environments across multiple repository types (npm, PyPI, Docker, Maven, Swift, Terraform, etc.). These fixes aim to enhance system reliability, correctness, and security. Scope of Impact npm and PyPI Repositories: Logical errors in the metadata cache for group repositories, resulting in inaccurate package index page caching. npm audit requests failing to complete successfully when no dependencies are present. Group repositories failing to correctly display all package files or apply policy-based version filtering. APT proxy repositories unable to correctly serve cached packages after upstream packages are removed. PyPI proxy repositories failing to support empty Remote Index Path settings. Docker Repositories: Failure to remove associated tags when deleting Docker Manifests, compromising repository integrity. Garbage collection failing to correctly process all Manifests, creating a risk of data loss. Inability to accept image names containing consecutive underscores. Improper limits on tag list requests, leading to timeouts or crashes. Improper handling of firewall timeout errors (returning 504 instead of 404). Logical errors in anonymous pull permission evaluation. Container startup scripts causing duplicate JVM memory parameters. Inability to recognize and process zstd compressed layers. Returning incorrect HTTP status codes (400 Bad Request instead of 404 Not Found) when remote content validation fails. Other Repository Formats: Maven: Strict content type validation rejecting macOS Mach-O executables; errors in cleanup policy evaluation. Swift/Terraform: Proxy configuration requires UI interaction; Terraform module archives not automatically repackaged. Hugging Face: Inability to correctly handle filenames containing spaces and special characters. Conan: Inability to accept metadata files from Conan 2.0 clients; returning invalid JSON when searching for non-existent packages. Yum: Inability to correctly identify the architecture of signed RPM packages. Go: Failure to remove associated components when deleting folders. System Stability and High Availability: IQ Server integration causing system deadlocks or unresponsive nodes. Failure to retrieve concurrent threat requests between high-availability nodes. Session timeout settings not correctly applied in HA deployments. Memory exhaustion caused by scanning large files (500MB+). Remediation Plan Version Upgrade: Upgrade Sonatype Nexus Repository to version 3.91.0. Specific Remediation Measures: Cache and Metadata: Optimize caching logic for npm and PyPI group repositories to ensure metadata accuracy and correct application of policy filtering. Docker Behavior Correction: Rectify Manifest deletion, garbage collection algorithms, tag list limits, and error status code return logic (e.g., changing 400 to 404). Enhanced Compatibility: Support for macOS Mach-O files, Conan 2.0 metadata, and filenames containing special characters. Stability Improvements: Resolve deadlock issues caused by IQ Server integration, optimize concurrent request handling and session timeout settings in high-availability environments, and introduce stream parsers to handle large file scanning.

Goal Reached Thanks to every supporter — we hit 100%!

Sonatype Nexus Repository 3.91.0 Vulnerability Fixes Summary