https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:54:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265587 EUVD-2026-265587 https://cve.radiocsirt.org/vuln/euvd-2026-265587 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68702 <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, &#39;0&#39;) when it should use padLeft(64, &#39;0&#39;) because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.</p> <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, &#39;0&#39;) when it should use padLeft(64, &#39;0&#39;) because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68702 https://cve.radiocsirt.org/vuln/ghsa-67rj-pjg6-pq59 <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626</p> <p>`padLeft(32, &#39;0&#39;)` should be `padLeft(64, &#39;0&#39;)`. SHA-256 produces 32 bytes = 64 hex characters.</p> <p>### Impact</p> <p>* Inconsistent hash lengths when leading bytes are zero * Comparison failures for hashes with leading zeros * Potential security issues in hash-based comparisons * Could cause subtle bugs in systems relying on consistent hash lengths</p> <p>Severity is considered low for internal uses of this library but if there&#39;s any consumer using these methods directly then this is considered high.</p> <p>### Patches</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>Use an alternate SHA-256 hash function or upgrade.</p> <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626</p> <p>`padLeft(32, &#39;0&#39;)` should be `padLeft(64, &#39;0&#39;)`. SHA-256 produces 32 bytes = 64 hex characters.</p> <p>### Impact</p> <p>* Inconsistent hash lengths when leading bytes are zero * Comparison failures for hashes with leading zeros * Potential security issues in hash-based comparisons * Could cause subtle bugs in systems relying on consistent hash lengths</p> <p>Severity is considered low for internal uses of this library but if there&#39;s any consumer using these methods directly then this is considered high.</p> <p>### Patches</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>Use an alternate SHA-256 hash function or upgrade.</p> https://cve.radiocsirt.org/vuln/ghsa-67rj-pjg6-pq59