PT-2026-2496 · Cloudbees+1 · Jenkins+1

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-68703

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, is affected by an issue where the salt used in encryption is derived from the SHA256 sum of the passphrase. This means that using the same password for two encryption operations will result in the same derived key.

Recommendations Update to version 2.2 or later.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2025-68703

GHSA-36H5-VRQ6-PP34

Affected Products

Jenkins

Jervis

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68703.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Patch
• https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-36h5-vrq6-pp34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68703 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68703 · Vendor Advisory
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870 · Note
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895 · Note
• https://github.com/samrocketman/jervis · Note
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Note
• https://twitter.com/CVEnew/status/2011181483080499326 · Twitter Post