CVE-2025-68703
📋 TL;DR
This vulnerability in Jervis (a library for Jenkins pipeline scripts) uses a weak key derivation method where the same password always produces the same encryption key. This allows attackers who obtain encrypted data to potentially decrypt it if they can guess or brute-force the password. Anyone using Jervis versions before 2.2 for encrypting sensitive pipeline data is affected.
💻 Affected Systems
- Jervis (Jenkins Job DSL/pipeline library)
📦 What is this software?
Jervis by Samrocketman
⚠️ Risk & Real-World Impact
Worst Case
Attackers decrypt all encrypted pipeline secrets, gaining access to credentials, API keys, and sensitive configuration data stored in Jenkins pipelines.
Likely Case
Attackers with access to encrypted artifacts or configuration files can perform offline brute-force attacks to recover passwords and access some pipeline secrets.
If Mitigated
With strong, unique passwords and limited access to encrypted artifacts, impact is reduced to theoretical risk with minimal practical exposure.
🎯 Exploit Status
Exploitation requires access to encrypted data and ability to perform password guessing/brute-force attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2
Vendor Advisory: https://github.com/samrocketman/jervis/security/advisories/GHSA-36h5-vrq6-pp34
Restart Required: No
Instructions:
1. Update Jervis to version 2.2 or later
2. Re-encrypt any secrets using the updated version
3. Rotate any potentially compromised credentials
🔧 Temporary Workarounds
Use external secret management
allStore pipeline secrets in Jenkins Credentials Plugin or external secret managers instead of Jervis encryption
Implement strong password policies
allUse long, complex, unique passwords for Jervis encryption to make brute-force attacks impractical
🧯 If You Can't Patch
- Rotate all secrets encrypted with vulnerable Jervis versions immediately
- Restrict access to encrypted artifacts and configuration files containing Jervis-encrypted data
🔍 How to Verify
Check if Vulnerable:
Check Jervis version in Jenkins pipeline scripts or shared library configuration. Versions before 2.2 are vulnerable.Check Version:
Check Jenkins pipeline scripts or shared library configuration for Jervis version specificationVerify Fix Applied:
Confirm Jervis version is 2.2 or later and verify encryption operations now use proper key derivation with unique salts.📡 Detection & Monitoring
Log Indicators:
- Failed decryption attempts
- Multiple encryption operations with same parameters
Network Indicators:
- Unusual access patterns to Jenkins artifacts containing encrypted data
SIEM Query:
Search for Jervis library usage with version <2.2 in Jenkins configuration or pipeline scripts