CVE-2025-68703: Jervis has a Salt for PBKDF2 derived from password

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17
Weakness: CWE-326

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

Affected products

samrocketman jervis: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: samrocketman jervis 2.2. Check the vendor advisory for mitigations.

References

https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34

Get alerted when CVE-2025-68703 or the next vulnerability affects your stack