CVE-2025-68698: high-severity vulnerability in samrocketman jervis
Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.1%
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). This vulnerability is fixed in 2.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
samrocketman · jervisRelated CVEs — samrocketman jervis
In the same product, most dangerous first.
CVE-2025-68704HIGHJervis has a Weak Random for Timing Attack MitigationEPSS 0.3%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%CVE-2025-68931HIGHJervis has AES CBC Mode Without AuthenticationEPSS 0.2%CVE-2025-68702HIGHJervis has a SHA-256 Hex String Padding BugEPSS 0.2%CVE-2025-68925MEDIUMJervis has a JWT Algorithm Confusion VulnerabilityEPSS 0.2%CVE-2025-68703HIGHJervis has a Salt for PBKDF2 derived from passwordEPSS 0.1%