https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:34:54.945054+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265586 EUVD-2026-265586 2026-10-06T08:34:54.947772+00:00 EUVD-2026-265586 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68703 fkie_cve-2025-68703 2026-10-06T08:34:54.947804+00:00

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.

 https://cve.radiocsirt.org/vuln/ghsa-36h5-vrq6-pp34 GHSA-36h5-vrq6-pp34 — Jervis's Salt for PBKDF2 derived from password 2026-10-06T08:34:54.947833+00:00

Affected: Maven: net.gleske:jervis

### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895

The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.

### Impact

Pre-computation attacks.

Severity is considered low for internal uses of this library and high for consumers of this library.

### Patches

Jervis will generate a random salt for each password and store it alongside the ciphertext.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [NIST SP 800-132: Password-Based Key Derivation](https://csrc.nist.gov/publications/detail/sp/800-132/final)