CVE-2025-68703

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68703
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68703.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68703
Aliases
Published
2026-01-13T19:27:33.177Z
Modified
2026-01-22T03:51:16.569649Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jervis has a Salt for PBKDF2 derived from password
Details

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

Database specific 
{
    "cwe_ids": [
        "CWE-326"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68703.json"
}
References

Affected packages

Git / github.com/samrocketman/jervis

Affected ranges

Type
GIT
Repo
https://github.com/samrocketman/jervis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2600d719c04c0450b86a0486b4676f3d5f24b7d4

Affected versions

jervis-0.*

jervis-0.1
jervis-0.10
jervis-0.11
jervis-0.12
jervis-0.13
jervis-0.2
jervis-0.3
jervis-0.4
jervis-0.5
jervis-0.5.1
jervis-0.5.2
jervis-0.6
jervis-0.7
jervis-0.8
jervis-0.9

jervis-1.*

jervis-1.0
jervis-1.1
jervis-1.2
jervis-1.3
jervis-1.4
jervis-1.5
jervis-1.6
jervis-1.7

jervis-2.*

jervis-2.0
jervis-2.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68703.json"