CVE-2025-68703 — Jervis has a Salt for PBKDF2 derived from password
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations wit…
Published: 2026-01-13 · CVSS: 8.7 · CVSS 4.0
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7