CVE-2025-68703 json
Jervis has a Salt for PBKDF2 derived from password
published 9mo ago modified 4mo ago also GHSA-36h5-vrq6-pp34 , EUVD-2026-2025
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.
Patch / fix
- maven net.gleske:jervis 2.2
- samrocketman jervis 2.2
Is CVE-2025-68703 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.gleske:jervis | <2.2 |
2.2 |
Affected products
- samrocketman jervis
Classification
- Weakness
-
- CWE-326 Inadequate Encryption Strength
References
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web, patch
-
github.com
/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34
web, patch, vendor-advisory
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-68703
advisory
-
github.com
/samrocketman/jervis
package
-
github.com
/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/Sec
web
-
github.com
/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/Sec
web
Sources
- CVE List CVE-2025-68703
- GitHub Advisory GHSA-36h5-vrq6-pp34
- NVD CVE-2025-68703
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.