CVE-2025-68698: Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17
Weakness: CWE-327

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). This vulnerability is fixed in 2.2.

Affected products

samrocketman jervis: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: samrocketman jervis 2.2. Check the vendor advisory for mitigations.

References

https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
https://github.com/samrocketman/jervis/security/advisories/GHSA-mqw7-c5gg-xq97

Get alerted when CVE-2025-68698 or the next vulnerability affects your stack