Java 8 version vulnerability in nexus repository docker image

post by anis.n.shaikh on Feb 11, 2022

Hi team,

We are using nexus 3.29.0 docker image as docker image repository and maven repository.

One of our customers reported java version 1.8.0.272 vulnerability for nexus docker image.

We have tried to upgrade subversion of java-1.8 inside nexus from 1.8.0.272 to 1.8.0.312 following are the observation of the upgrade:

1. It directly upgraded to 1.8.0.322.
2. We tried to manually upgrade the java-1.8.0.312 which resulted in downgrade of some OS components (libgif.so.4, libpng15.so.15, libpng15.so.15(PNG15_0)).

Though 1.8.0.322 works well in our dev environment but we are not sure how it will work in prod environment.

So we would need your help in understanding nexus’s plan to support of latest versions of Java 8.

post by mpiggott on Feb 15, 2022

We don’t update the images for old releases, you’ll need to update to newer a newer version of Nexus.

post by aashish.mewc on Feb 16, 2022

Thanks Matthew for your reply. But we want to understand if nexus has any plans to support latest versions of Java ?

post by mpiggott on Feb 16, 2022

As a general rule, when we build the image it will have the latest JVM available unless a JVM bug prevents it. Your version of Nexus is 3.29.0 which was released over a year ago. If you want a newer version of Java, use a docker image for a newer version of Nexus.

post by aashish.mewc on Feb 21, 2022

Thanks Matthew. Just one last confirmation, has your team tested the current version of nexus with latest version of Java ?

post by mmartz on Feb 22, 2022

Repository Manager works with Java 8 but needs some changes before it will work with later versions. I’m not sure when that work has been scheduled to be done.