8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68702

CVE-2025-68702: Jervis Has a SHA-256 Hex String Padding Bug

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64, '0') because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68702

CVE-2025-68702:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the sha256Sum static method within the net.gleske.jervis.tools.SecurityIO class. The analysis of the provided patch c3981ff71de7b0f767dfe7b37a2372cb2a51974a clearly shows the fix for this issue. The code was changed from padLeft(32, '0') to padLeft(64, '0'). This corrects the logic to ensure that the generated SHA-256 hash is always 64 characters long, by padding with leading zeros if necessary. The vulnerability would be triggered anytime this function is called to generate a SHA-256 hash of an input that results in a hash with one or more leading zero bytes. This would cause failures in any downstream logic that depends on a fixed-length 64-character hex string for comparison or storage, potentially leading to security issues if used for integrity checks or as a key in a map. The commit also contains several other important security enhancements, such as switching to AES/GCM/NoPadding to prevent padding oracle attacks and using OAEP padding for RSA encryption to prevent Bleichenbacher attacks, but the specific vulnerability identified by GHSA-67rj-pjg6-pq59 is the SHA-256 padding bug.

Vulnerable functions

net.gleske.jervis.tools.SecurityIO.sha256Sum

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

The function `sha256Sum` incorrectly padded the resulting SHA-256 hex string to 32 characters instead of the required 64. A SHA-256 hash is 32 bytes, which is represented by 64 hexadecimal characters. This bug would cause hashes with leading zeros to be truncated, leading to inconsistent hash lengths and incorrect hash comparisons.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.