Approved changes feed: RSS · Atom
cpe:2.3:a:samrocketman:jervis:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Samrocketman (a8f8c371-5b19-59dd-bb3f-143f12fcdce7) |
|---|---|
| Product | Jervis (151de6ca-44fc-5bdf-a09b-db2f143249bc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/samrocketman/jervis |
purl2cpe | 2026-06-01 10:15:27.191733 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-68931 |
vulnerable | 2026-06-08 07:41:21.949658 |
Jervis has AES CBC Mode Without Authentication
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation. This vulnerability is fixed in 2.2.
Published: 2026-01-13T19:17:26.920Z
Updated: 2026-01-13T19:56:21.675Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68925 |
vulnerable | 2026-06-08 07:41:21.918599 |
Jervis has a JWT Algorithm Confusion Vulnerability
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vulnerability is fixed in 2.2.
Published: 2026-01-13T19:30:05.513Z
Updated: 2026-01-13T19:53:48.021Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68704 |
vulnerable | 2026-06-08 07:41:21.666736 |
Jervis has a Weak Random for Timing Attack Mitigation
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.
Published: 2026-01-13T19:29:06.771Z
Updated: 2026-01-13T19:54:12.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68703 |
vulnerable | 2026-06-08 07:41:21.666492 |
Jervis has a Salt for PBKDF2 derived from password
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.
Published: 2026-01-13T19:27:33.177Z
Updated: 2026-01-13T19:54:40.542Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68702 |
vulnerable | 2026-06-08 07:41:21.666237 |
Jervis has a SHA-256 Hex String Padding Bug
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64, '0') because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.
Published: 2026-01-13T19:26:32.543Z
Updated: 2026-01-13T19:55:16.378Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68701 |
vulnerable | 2026-06-08 07:41:21.665956 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68698 |
vulnerable | 2026-06-08 07:41:21.658964 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.