https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:56:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265586 EUVD-2026-265586 https://cve.radiocsirt.org/vuln/euvd-2026-265586 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68703 <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.</p> <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68703 https://cve.radiocsirt.org/vuln/ghsa-36h5-vrq6-pp34 <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895</p> <p>The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.</p> <p>### Impact</p> <p>Pre-computation attacks.</p> <p>Severity is considered low for internal uses of this library and high for consumers of this library.</p> <p>### Patches</p> <p>Jervis will generate a random salt for each password and store it alongside the ciphertext.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [NIST SP 800-132: Password-Based Key Derivation](https://csrc.nist.gov/publications/detail/sp/800-132/final)</p> <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895</p> <p>The salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key.</p> <p>### Impact</p> <p>Pre-computation attacks.</p> <p>Severity is considered low for internal uses of this library and high for consumers of this library.</p> <p>### Patches</p> <p>Jervis will generate a random salt for each password and store it alongside the ciphertext.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [NIST SP 800-132: Password-Based Key Derivation](https://csrc.nist.gov/publications/detail/sp/800-132/final)</p> https://cve.radiocsirt.org/vuln/ghsa-36h5-vrq6-pp34