CVE-2025-68931
Jervis has AES CBC Mode Without Authentication
Résumé
Jervis has AES CBC Mode Without Authentication
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation. This vulnerability is fixed in 2.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com