CVE-2025-68698 - Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Back Back to CVE browser

HIGH

Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Published Jan 13, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.14%

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). This vulnerability is fixed in 2.2.

Affected products

Vendor Samrocketman Product Jervis Default
n/a
- Version
  < 2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Samrocketman

Jervis

n/a

Version	Status	Constraints
< 2.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (7)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2028		Advisory
https://github.com/advisories/GHSA-mqw7-c5gg-xq97		Advisory
https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465
https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497
https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a		x_refsource_MISCPatch
https://github.com/samrocketman/jervis/security/advisories/GHSA-mqw7-c5gg-xq97		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68698