CVE-2025-68703

Jervis has a Salt for PBKDF2 derived from password

State: Published
Severity: 8.7 High
Published: Jan 13, 2026
Updated: Jan 13, 2026
Reserved: Dec 23, 2025

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-326 Inadequate Encryption Strength

Affected Products

Product	Versions
jervissamrocketman	< 2.2Affected

References

https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34
https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.