CVE-2025-68931: fallo de gravedad alta en samrocketman jervis
Jervis has AES CBC Mode Without Authentication
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.2%
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation. This vulnerability is fixed in 2.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
samrocketman · jervisCVEs relacionadas — samrocketman jervis
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-68704HIGHJervis has a Weak Random for Timing Attack MitigationEPSS 0.3%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%CVE-2025-68702HIGHJervis has a SHA-256 Hex String Padding BugEPSS 0.2%CVE-2025-68925MEDIUMJervis has a JWT Algorithm Confusion VulnerabilityEPSS 0.2%CVE-2025-68698HIGHJervis has an RSA PKCS#1 v1.5 Padding VulnerabilityEPSS 0.1%CVE-2025-68703HIGHJervis has a Salt for PBKDF2 derived from passwordEPSS 0.1%