PT-2026-2556 · Cloudbees+1 · Jenkins+1

CVE-2025-68925 · Publicado 2026-01-13 · Atualizado 2026-01-13

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description The Jervis library, used for Job DSL plugin scripts and shared Jenkins pipeline libraries, does not validate the algorithm specified in the JWT header, specifically checking for "alg":"RS256". This could potentially allow for unauthorized access or manipulation of Jenkins pipelines.

Recommendations Update Jervis to version 2.2 or later.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2025-68925

GHSA-5PQ9-5MPR-JJ85

Produtos afetados

Jenkins

Jervis

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68925.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Correção
• https://github.com/samrocketman/jervis/security/advisories/GHSA-5pq9-5mpr-jj85 · Correção
• https://github.com/samrocketman/jervis · Nota
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249 · Nota
• https://osv.dev/vulnerability/GHSA-5pq9-5mpr-jj85 · Aviso do Fabricante
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-68925 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011181481121759368 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68925 · Aviso do Fabricante