# Critical Cleanup Policy Bug Advisory

This bug is fixed in release 3.41.1, which is now available. Please [download](https://help.sonatype.com/en/download.html "Download") and upgrade to this or a later release.

Sonatype has discovered a critical bug that can cause [cleanup policies](https://help.sonatype.com/en/cleanup-policies.html "Cleanup Policies") to unintentionally delete binaries in Nexus Repository deployments using H2 or PostgreSQL.

## Who is Impacted?

Deployments meeting **all** of the following criteria are impacted by this bug:

- Your deployment must be using Nexus Repository 3.31.0 to 3.41.0  
- Your deployment must have been explicitly migrated to or originally deployed using an **H2** or **PostgreSQL** database  
- Cleanup policies must be applied to one or more repositories  
- Those cleanup policies must have _Component Age_ or _Component Usage_ criteria

## What Database am I Using?

If you are unsure what database you are using, take the following steps:

- Check your `$data-dir/etc/nexus.properties` for `nexus.datastore.enabled=true`

- Property **does not exist** \- you are using OrientDB and are not impacted by this bug
  
  - Property **does** exist - you are using either H2 or PostgreSQL and are potentially impacted by this bug

- If there is also a `$nexus-dir/etc/fabric/nexus-store.properties` file that contains a Postgres JDBC URL, then you are using PostgreSQL
    
    - If no Postgres JDBC URL exists, but you do have `nexus.datastore.enabled=true` in your `$data-dir/etc/nexus.properties`, then you are using H2

Or

- Log into your Nexus Repository instance as an administrator

- Navigate to _Admininistration_ → _Repository_ and see if there is a _Data Store_ menu item available

- Menu item **does not exist** \- you are using OrientDB and are not impacted by this bug
  
  - Menu item **does** exist - you are using either H2 or PostgreSQL and are potentially impacted by this bug

## What Should You Do if You are Currently Impacted?

If your deployment meets all of the above criteria, you should immediately take the following actions:

- Disable cleanup policy tasks
  
  - Navigate to _Admin_ → _System_ → _Tasks_
  - Locate the _Cleanup Service_ task in the task list; select this task to open the detailed view
  - Uncheck the _Task enabled_ box

- Disable the blob store compact task (if using File or Azure Blob Stores)
  
  - Navigate to _Admin_ → _System_ → _Tasks_
  - Locate the _Admin - Compact blob store_ task; select this task to open to detailed view
  - Uncheck the _Task enabled_ box

- Disable S3 Lifecycle Rules (if using S3 Blob Stores, see [https://aws.amazon.com/blogs/aws/amazon-s3-lifecycle-management-update/](https://aws.amazon.com/blogs/aws/amazon-s3-lifecycle-management-update/))
- Disable Azure Blob Storage Lifecycle Rules if configured on the Azure side (if using Azure Blob Stores, see [https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview?tabs=azure-portal](https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview?tabs=azure-portal))
- Preserve backup media that have already been made of your Nexus Repository deployment

## How Can You Prevent Impact if Not Currently Affected?

If your deployment does not meet all of the above criteria, you should take the following actions to prevent impact:

- If not currently using H2 or PostgreSQL, do not migrate at this time
- If you are already using H2 or PostgreSQL and have any cleanup policies, disable the cleanup policy tasks and blob store cleanup task:
  
  - Navigate to _Admin_ → _System_ → _Tasks_
  - Locate the _Cleanup Service_ task and the _Admin - Compact blob store_ task in the task list; select each task to open the detailed view
  - Uncheck the _Task enabled_ box for each task

- If you are already using H2 or PostgreSQL, do not create new cleanup policies.