8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68698

CVE-2025-68698: Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68698

CVE-2025-68698:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the jervis library because it uses RSA with PKCS#1 v1.5 padding (PKCS1Encoding), which is known to be susceptible to padding oracle attacks (Bleichenbacher's attack). The core of the vulnerability lies in the net.gleske.jervis.tools.SecurityIO.rsaEncryptBytes and net.gleske.jervis.tools.SecurityIO.rsaDecryptBytes functions, which directly implement the insecure RSA operations.

The patch addresses this by introducing new methods (rsaEncryptBytesOaep, rsaDecryptBytesOaep) that use the more secure OAEP padding and deprecating the old, vulnerable functions. The CipherMap class, which manages encrypted data, was also updated to use these new OAEP-based methods for encrypting and decrypting the underlying AES keys.

An attacker who can submit crafted ciphertexts to an application using the vulnerable rsaDecryptBytes function and observe differences in error messages or timing could progressively decrypt sensitive information, such as the AES keys used for data encryption within CipherMap. This would compromise the confidentiality of all data encrypted by the CipherMap instance.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.