https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:58:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265588 EUVD-2026-265588 https://cve.radiocsirt.org/vuln/euvd-2026-265588 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68701 <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2.</p> <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68701 https://cve.radiocsirt.org/vuln/ghsa-crxp-chh4-9ghp <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900</p> <p>Same passphrase + same plaintext = same ciphertext (IV reuse)</p> <p>### Impact</p> <p>Severity is considered low for internal uses of this library but if there&#39;s any consumer using these methods directly then this is considered high.</p> <p>Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.</p> <p>### Patches</p> <p>Random IV will be generated and prepended to the ciphertext.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900</p> <p>Same passphrase + same plaintext = same ciphertext (IV reuse)</p> <p>### Impact</p> <p>Severity is considered low for internal uses of this library but if there&#39;s any consumer using these methods directly then this is considered high.</p> <p>Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.</p> <p>### Patches</p> <p>Random IV will be generated and prepended to the ciphertext.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> https://cve.radiocsirt.org/vuln/ghsa-crxp-chh4-9ghp