Jervis's Salt for PBKDF2 derived from password

高 7.5CVE-2025-68703 · GHSA-36h5-vrq6-pp34 · 13/01/2026 公開 · 17/06/2026 更新

要点

CVE-2025-68703 は net.gleske:jervis, jervis (samrocketman) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.13%（全脆弱性の 2.8% より高い）。
対処：2.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
net.gleske:jervis Maven	`< 2.2`	`2.2`
jervis samrocketman	`< 2.2`	`2.2`

概要

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895

The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.

Impact

Pre-computation attacks.

Severity is considered low for internal uses of this library and high for consumers of this library.

Patches

Jervis will generate a random salt for each password and store it alongside the ciphertext.

Upgrade to Jervis 2.2.

Workarounds

None

References

NIST SP 800-132: Password-Based Key Derivation

NVD の説明

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.