CVE-2025-68703

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

Score

CVSS 4.0 8.7 High

Status

Analyzed - security-advisories@github.com

Published

2026-01-13

Last modified

2026-01-13

Weaknesses

CWE-326

Affected products

• Jervis (Samrocketman)

References

• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
• https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34