PT-2026-2493 · Jervis · Jervis

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-68698

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, utilizes PKCS1Encoding, which is susceptible to Bleichenbacher padding oracle attacks. Modern systems should employ OAEP (Optimal Asymmetric Encryption Padding) for enhanced security. This issue has been addressed in version 2.2. A Bleichenbacher padding oracle attack exploits weaknesses in the PKCS#1 v1.5 padding scheme used in certain cryptographic algorithms.

Recommendations Update Jervis to version 2.2 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2025-68698

GHSA-MQW7-C5GG-XQ97

Affected Products

Jervis

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68698.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Patch
• https://github.com/samrocketman/jervis/security/advisories/GHSA-mqw7-c5gg-xq97 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68698 · Security Note
• https://osv.dev/vulnerability/GHSA-mqw7-c5gg-xq97 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68698 · Vendor Advisory
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497 · Note
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465 · Note
• https://github.com/samrocketman/jervis · Note
• https://twitter.com/CVEnew/status/2011181487354495331 · Twitter Post