CVE-2025-68931: 
Java vulnerability analysis and mitigation

CVE-2025-68931 is a cryptographic vulnerability in Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to version 2.2, the library's SecurityIO.groovy uses AES/CBC/PKCS5Padding without authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation (CWE-287, CWE-327). It affects all versions of net.gleske:jervis before 2.2. The vulnerability was published on January 13, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is the use of unauthenticated AES-256-CBC (AES/CBC/PKCS5Padding) in SecurityIO.groovy (lines 682–684 and 720–722), which lacks any message authentication code (MAC) or authenticated encryption, classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-287 (Improper Authentication). Without authentication, an attacker with network access can perform padding oracle attacks — iteratively manipulating ciphertext blocks and observing decryption behavior to recover or forge plaintext. The vulnerable code initializes the cipher as Cipher.getInstance('AES/CBC/PKCS5Padding') without appending a HMAC or using an AEAD mode, allowing ciphertext tampering to go undetected before decryption. While Jervis applies RSA encryption over AES keys and a SHA-256 checksum on the outer encrypted blob, the inner AES-CBC layer itself remains unauthenticated (GitHub Advisory, Patch Commit).

The primary impact is an integrity violation: a network-accessible attacker could potentially forge or manipulate encrypted GitHub App authentication tokens stored by Jervis. For direct consumers of the SecurityIO library methods (outside of Jervis's internal multi-layered protections), the severity is considered critical. Within Jervis's own usage, mitigating factors include RSA-encrypted AES keys, SHA-256 checksums on encrypted blobs, local-only storage inaccessible from the web, and one-hour token expiration windows — reducing practical exploitability but not eliminating the cryptographic weakness (GitHub Advisory).

The fix is to upgrade Jervis to version 2.2 or later, which migrates the symmetric encryption from AES/CBC/PKCS5Padding to AES/GCM/NoPadding (authenticated encryption) and switches RSA padding from PKCS1 to OAEP to prevent Bleichenbacher attacks. Note that CipherMap encrypted data will be discarded upon upgrading to 2.2, causing new GitHub App tokens to be issued rather than reusing old ones — this is expected behavior given the one-hour token expiration. No workarounds are available; upgrading is the only remediation (GitHub Advisory, Patch Commit).