Jervis's Salt for PBKDF2 derived from password

CAO 7.5CVE-2025-68703 · GHSA-36h5-vrq6-pp34 · Công bố 13/01/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-68703 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng net.gleske:jervis, jervis (samrocketman).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.13%, cao hơn 2.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
net.gleske:jervis Maven	`< 2.2`	`2.2`
jervis samrocketman	`< 2.2`	`2.2`

Mô tả

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895

The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.

Impact

Pre-computation attacks.

Severity is considered low for internal uses of this library and high for consumers of this library.

Patches

Jervis will generate a random salt for each password and store it alongside the ciphertext.

Upgrade to Jervis 2.2.

Workarounds

None

References

NIST SP 800-132: Password-Based Key Derivation

Mô tả của NVD

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.