| Package | Affected versions | Patched versions |
|---|---|---|
| net.gleske:jervis | < 2.2 | 2.2 |
| jervis | < 2.2 | 2.2 |
The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.
Pre-computation attacks.
Severity is considered low for internal uses of this library and high for consumers of this library.
Jervis will generate a random salt for each password and store it alongside the ciphertext.
Upgrade to Jervis 2.2.
None
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free