CVE-2025-68698

High

Published: 13 January 2026

Published

13 January 2026

Modified

20 January 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0013 2.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-68698 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Samrocketman Jervis. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68698 affects Jervis, a library used for Job DSL plugin scripts and shared Jenkins pipeline libraries. In versions prior to 2.2, Jervis employs PKCS1Encoding, which is susceptible to Bleichenbacher padding oracle attacks due to its reliance on outdated RSA encryption padding. Modern cryptographic practices recommend OAEP (Optimal Asymmetric Encryption Padding) instead. The vulnerability is classified under CWE-327 (Broken or Risky Cryptographic Algorithm) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.

Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low complexity. Successful exploitation enables a Bleichenbacher padding oracle attack, allowing decryption of sensitive data encrypted with the vulnerable scheme, while integrity and availability remain unaffected.

The vulnerability is addressed in Jervis version 2.2, which replaces PKCS1Encoding with a secure alternative. Relevant details are available in the GitHub security advisory (GHSA-mqw7-c5gg-xq97) and the fixing commit (c3981ff71de7b0f767dfe7b37a2372cb2a51974a). Security practitioners using Jervis in Jenkins environments should upgrade to 2.2 or later to mitigate the risk.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-2028

Vulnerability details

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). This vulnerability is…

fixed in 2.2.