CVE-2025-68698
📋 TL;DR
Jervis versions before 2.2 use vulnerable PKCS1Encoding for RSA encryption, making them susceptible to Bleichenbacher padding oracle attacks. This could allow attackers to decrypt sensitive data or forge signatures. Organizations using Jervis for Jenkins pipeline automation are affected.
💻 Affected Systems
- Jervis
📦 What is this software?
Jervis by Samrocketman
⚠️ Risk & Real-World Impact
Worst Case
Attackers could decrypt sensitive credentials, tokens, or configuration data stored or transmitted using Jervis's encryption, potentially leading to complete system compromise.
Likely Case
Attackers could decrypt specific encrypted data elements, potentially exposing pipeline secrets, credentials, or sensitive configuration data.
If Mitigated
With proper network segmentation and access controls, impact would be limited to the specific Jenkins instance using vulnerable Jervis.
🎯 Exploit Status
Bleichenbacher attacks require the ability to interact with the padding oracle, typically through network access to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2
Vendor Advisory: https://github.com/samrocketman/jervis/security/advisories/GHSA-mqw7-c5gg-xq97
Restart Required: Yes
Instructions:
1. Update Jervis to version 2.2 or later. 2. Update Jenkins pipeline libraries using Jervis. 3. Restart Jenkins instances using updated Jervis libraries.
🔧 Temporary Workarounds
Disable RSA encryption in Jervis
allIf RSA encryption features are not required, disable them in Jervis configuration.
# Modify Jervis configuration to disable RSA encryption features
# Check Jervis documentation for specific configuration options
🧯 If You Can't Patch
- Isolate Jenkins instances using Jervis behind strict network controls.
- Monitor for unusual decryption attempts or padding oracle interactions.
🔍 How to Verify
Check if Vulnerable:
Check Jervis version in Jenkins pipeline libraries or shared library configuration. Versions before 2.2 are vulnerable.Check Version:
# Check Jervis version in Jenkins pipeline: Review Jenkinsfile and shared library configurations for Jervis versionVerify Fix Applied:
Verify Jervis version is 2.2 or later in Jenkins pipeline configuration and shared libraries.📡 Detection & Monitoring
Log Indicators:
- Unusual RSA decryption attempts
- Multiple failed decryption operations with timing patterns characteristic of padding oracle attacks
Network Indicators:
- Repeated RSA ciphertext submissions to Jenkins/Jervis endpoints
- Unusual traffic patterns to Jenkins pipeline endpoints
SIEM Query:
source="jenkins" AND (event_type="decryption_failure" OR message="padding error")