Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to…

What to know

What it is

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.

Affected

See advisory

Fix

Apply the vendor's security update; see the linked advisory.

Exploitation

No known exploitation