CVE-2025-68701

Published: Jan 13, 2026

Modified: Jan 13, 2026

PUBLISHED

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2.

Vendor	Product	Versions
samrocketman	jervis	affected `< 2.2`

Weaknesses (CWE)

CWE-327

CWE-340

References

https://github.com/samrocketman/jervis/security/advisories/GHSA-crxp-chh4-9ghp

x_refsource_CONFIRM

https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-68701

Description

Affected Products

Weaknesses (CWE)

References