8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68703

CVE-2025-68703: Jervis has a Salt for PBKDF2 derived from password

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68703

CVE-2025-68703:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the static salt generation for passphrase-based encryption within the net.gleske.jervis.tools.SecurityIO class. The analysis of the patch commit c3981ff71de7b0f767dfe7b37a2372cb2a51974a clearly shows that the functions encryptWithAES256(String passphrase, ...) and decryptWithAES256(String passphrase, ...) use the SHA256 hash of the passphrase as the salt for the Password-Based Key Derivation Function (PBKDF2). The line String salt = sha256Sum(passphrase.bytes).toLowerCase() is the exact source of the vulnerability. This deterministic salt generation allows an attacker to pre-compute a dictionary of passphrases to their corresponding encryption keys (a rainbow table), significantly weakening the security of the encryption. The patch addresses this by deprecating these functions and introducing new GCM-based methods (encryptWithPassphraseGCM, decryptWithPassphraseGCM) that correctly use a randomly generated salt for each encryption operation and store it alongside the ciphertext. The identified vulnerable functions are the ones that would be called to trigger this flawed cryptographic implementation.

Vulnerable functions

net.gleske.jervis.tools.SecurityIO.encryptWithAES256

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

This function uses a salt that is deterministically derived from the passphrase by SHA256-hashing it. This means that any two encryption operations with the same passphrase will use the same salt, leading to the same derived key. This makes the encryption vulnerable to pre-computation attacks like rainbow tables. The salt should be randomly generated for each encryption.

net.gleske.jervis.tools.SecurityIO.decryptWithAES256

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

This function re-derives the salt from the passphrase in the same deterministic way as the encryption function. This is necessary to decrypt the data, but it confirms the underlying vulnerability of using a non-random, password-derived salt for key derivation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.