CVE-2025-68703: fallo de gravedad alta en samrocketman jervis
Jervis has a Salt for PBKDF2 derived from password
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.1%
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
samrocketman · jervisCVEs relacionadas — samrocketman jervis
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-68704HIGHJervis has a Weak Random for Timing Attack MitigationEPSS 0.3%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%CVE-2025-68931HIGHJervis has AES CBC Mode Without AuthenticationEPSS 0.2%CVE-2025-68702HIGHJervis has a SHA-256 Hex String Padding BugEPSS 0.2%CVE-2025-68925MEDIUMJervis has a JWT Algorithm Confusion VulnerabilityEPSS 0.2%CVE-2025-68698HIGHJervis has an RSA PKCS#1 v1.5 Padding VulnerabilityEPSS 0.1%