8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68701

CVE-2025-68701: Jervis has Deterministic AES IV Derivation from Passphrase

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68701

CVE-2025-68701:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Deterministic AES IV Derivation from Passphrase', is rooted in the static method encryptWithAES256(String passphrase, ...) within the net.gleske.jervis.tools.SecurityIO class. Analysis of the patch commit c3981ff71de7b0f767dfe7b37a2372cb2a51974a reveals that the Initialization Vector (IV) for AES encryption was being derived directly from the provided passphrase. Specifically, the line byte[] b_iv = passwordKeyDerivation(checksum, passphrase) shows that the IV is a predictable output based on the passphrase. This deterministic IV generation means that if the same passphrase is used to encrypt the same plaintext multiple times, the resulting ciphertext will always be identical. This violates the cryptographic principle that encryption should be non-deterministic (probabilistic) and makes the encrypted data susceptible to pattern analysis and other attacks. The patch addresses this by deprecating the vulnerable AES/CBC functions and introducing new functions (encryptWithPassphraseGCM) that use AES/GCM mode with a randomly generated salt for key derivation and a random nonce for each encryption operation, thus ensuring that each encryption of the same plaintext results in a unique ciphertext.

Vulnerable functions

net.gleske.jervis.tools.SecurityIO.encryptWithAES256(java.lang.String, java.lang.String, java.lang.Integer)

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

This function is vulnerable because it deterministically derives the Initialization Vector (IV) from the user-provided passphrase. The IV is generated by calling `passwordKeyDerivation(checksum, passphrase)`, where `checksum` is the SHA256 hash of the passphrase. As a result, the same passphrase will always produce the same IV. This reuse of the IV for multiple encryption operations with the same key (derived from the same passphrase) is a severe cryptographic flaw. It causes identical plaintext blocks to be encrypted into identical ciphertext blocks, allowing an attacker to perform pattern analysis on the encrypted data.

net.gleske.jervis.tools.SecurityIO.decryptWithAES256(java.lang.String, java.lang.String, java.lang.Integer)

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

This is the corresponding decryption function for the vulnerable `encryptWithAES256`. It is part of the vulnerable functionality as it uses the same flawed deterministic logic to re-derive the IV from the passphrase in order to decrypt the ciphertext. An attacker could potentially exploit this to verify guesses about the plaintext.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.