# Security vulnerable ：CVE-2022-2047 & CVE-2022-2048

**URL:** <https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045>\
**Category:** Sonatype Nexus Repository\
**Tags:** nexus-repository\
**Created:** [July 30, 2022, 12:39am UTC](https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045 "2022-07-30T00:39:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jiangbaiheng](https://avatars.discourse-cdn.com/v4/letter/j/e79b87/32.png) [@jiangbaiheng](https://community.sonatype.com/u/jiangbaiheng)\
**Post date:** [July 30, 2022, 12:39am UTC](https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045/1 "2022-07-30T00:39:46Z")

</div>

hello everyone:  
I use nexus repository oss, and the version is 3.34.0-01. My company conducted a security scan last night。 A security vulnerability was found in port 8082（used by Nexus-docker-repository），is about _Eclipse Jetty_，the CVE number is CVE-2022-2047 and CVE-2022-2048.  
I want to ask which version fixes this vulnerability at present？  
Or Whether jetty components can be upgraded separately?

---

<div class="post-metadata">

**Author:** ![ilpianista](https://avatars.discourse-cdn.com/v4/letter/i/9de0a6/32.png) [@ilpianista](https://community.sonatype.com/u/ilpianista)\
**Post date:** [March 20, 2023, 3:28pm UTC](https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045/2 "2023-03-20T15:28:52Z")

</div>

For anyone still interested in this, you need [at least 3.45.1-01](https://github.com/sonatype/nexus-public/commit/c43280a44a1c9c3e00a23e21ed4e0ac6ab3046f1).

To the devs: why isn’t this tracked in the [Security Advisories](https://help.sonatype.com/repomanager3/product-information/release-notes/security-advisories)?

---

<div class="post-metadata">

**Author:** ![mprescott](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mprescott/32/178_2.png) [@mprescott](https://community.sonatype.com/u/mprescott)\
**Post date:** [March 22, 2023, 8:13pm UTC](https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045/3 "2023-03-22T20:13:44Z")

</div>

It’s a fair question, @ilpianista. We do continuous dependency monitoring via Lifecycle, of course and we are upgrading dependencies regularly to reduce risk (since we consider everything potentially exploitable). However, we haven’t actively updated that page in a while. We have plans to revisit the processes we’re using to share this information out, so you may see this page change form in the future.

---

<div class="post-metadata">

**Author:** ![ilpianista](https://avatars.discourse-cdn.com/v4/letter/i/9de0a6/32.png) [@ilpianista](https://community.sonatype.com/u/ilpianista)\
**Post date:** [March 23, 2023, 8:25am UTC](https://community.sonatype.com/t/security-vulnerable-cve-2022-2047-cve-2022-2048/9045/4 "2023-03-23T08:25:06Z")

</div>

> We have plans to revisit the processes we’re using to share this information out, so you may see this page change form in the future.

That would be great, thanks!