PT-2026-2496 · Cloudbees+1 · Jenkins+1

CVE-2025-68703 · Publicado 2026-01-13 · Atualizado 2026-01-13

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, is affected by an issue where the salt used in encryption is derived from the SHA256 sum of the passphrase. This means that using the same password for two encryption operations will result in the same derived key.

Recommendations Update to version 2.2 or later.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2025-68703

GHSA-36H5-VRQ6-PP34

Produtos afetados

Jenkins

Jervis

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68703.json · Exploit
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870 · Nota
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895 · Nota
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Correção
• https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34 · Aviso do Fabricante
• https://github.com/samrocketman/jervis · Nota
• https://osv.dev/vulnerability/GHSA-36h5-vrq6-pp34 · Aviso do Fabricante
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-68703 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-68703 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2011181483080499326 · Publicação no Twitter