CVE-2025-68702

Katalog CVE

CVSS 7.5 · High EPSS 0,17%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada samrocketman jervis. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64, '0') because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/samrocketman/jervis/security/advisories/GHSA-67rj-pjg6-pq59 patch · advisory vendor
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a patch