CVE-2025-68703

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a	Patch
https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samrocketman:jervis:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:59

Type	Values Removed	Values Added
Summary		(es) Jervis es una biblioteca para scripts del plugin Job DSL y bibliotecas compartidas de pipeline de Jenkins. Antes de la versión 2.2, la sal se deriva de sha256Sum(frase de contraseña). Dos operaciones de cifrado con la misma contraseña tendrán la misma clave derivada. Esta vulnerabilidad está corregida en la versión 2.2.

20 Jan 2026, 17:13

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Samrocketman Samrocketman jervis
CPE		cpe:2.3:a:samrocketman:jervis::::::::
References	~~() https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a -~~	() https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a - Patch
References	~~() https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34 -~~	() https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34 - Patch, Vendor Advisory

13 Jan 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 20:16

Updated : 2026-06-17 09:59

NVD link : CVE-2025-68703

Mitre link : CVE-2025-68703

CVE.ORG link : CVE-2025-68703

JSON object : View

Products Affected

samrocketman

jervis

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2025-68703", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68703", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T19:54:35.848146Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "samrocketman", "product": "jervis", "versions": [{"status": "affected", "version": "< 2.2"}]}]}], "published": "2026-01-13T20:16:07.537", "references": [{"url": "https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2."}, {"lang": "es", "value": "Jervis es una biblioteca para scripts del plugin Job DSL y bibliotecas compartidas de pipeline de Jenkins. Antes de la versi\u00f3n 2.2, la sal se deriva de sha256Sum(frase de contrase\u00f1a). Dos operaciones de cifrado con la misma contrase\u00f1a tendr\u00e1n la misma clave derivada. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.2."}], "lastModified": "2026-06-17T09:59:26.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samrocketman:jervis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1205448-6074-4B8A-B941-572D3D44F9E1", "versionEndExcluding": "2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}