CVE-2025-68931: Jervis Library Encryption Vulnerability

CVE-2025-68931 Overview

CVE-2025-68931 is a padding oracle attack vulnerability in Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to version 2.2, the library uses AES/CBC/PKCS5Padding encryption without proper authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation. This cryptographic weakness allows attackers to decrypt sensitive data or forge encrypted values without possessing the encryption key.

Critical Impact

Attackers can exploit this vulnerability to manipulate encrypted data or potentially decrypt sensitive information in Jenkins CI/CD pipelines using unauthenticated AES/CBC encryption.

Affected Products

• Jervis library versions prior to 2.2
• Jenkins environments using vulnerable Jervis library for Job DSL scripts
• Jenkins pipeline configurations leveraging shared Jervis libraries

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68931 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68931

Vulnerability Analysis

This vulnerability falls under CWE-287 (Improper Authentication) and represents a classic cryptographic weakness where encryption is used without authentication. The Jervis library implemented AES encryption in CBC mode with PKCS5 padding but failed to include an authentication mechanism such as HMAC or an authenticated encryption mode like GCM.

Without authentication, an attacker who can intercept or access encrypted data can mount a padding oracle attack. In this attack, the adversary iteratively manipulates ciphertext bytes and observes whether the decryption process accepts or rejects the modified padding. Through careful analysis of these responses, the attacker can progressively decrypt the entire ciphertext block by block.

The network-accessible nature of this vulnerability combined with no privilege requirements makes it particularly dangerous in CI/CD environments where Jenkins stores sensitive configuration data, credentials, and secrets that may be encrypted using this vulnerable implementation.

Root Cause

The root cause is the use of AES/CBC/PKCS5Padding without message authentication. CBC mode encryption alone provides confidentiality but does not protect against tampering. When PKCS5 padding validation errors are exposed (either directly through error messages or indirectly through timing differences), attackers can use these as an oracle to systematically decrypt data. The fix in version 2.2 addresses this by implementing proper authenticated encryption.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker with access to encrypted ciphertext can:

1. Capture encrypted data transmitted or stored by Jervis
2. Submit modified ciphertext to the decryption routine
3. Observe padding validation responses (valid/invalid)
4. Use differential analysis to deduce plaintext byte values
5. Repeat the process to decrypt the entire message or forge valid ciphertext

The vulnerability mechanism relies on the predictable padding validation behavior in PKCS5. When a ciphertext block is modified, the padding check will fail unless the attacker correctly guesses the intermediate state value. By systematically testing all 256 possible byte values for each position, the attacker can reverse the CBC decryption process. See the GitHub Security Advisory GHSA-gxp5-mv27-vjcj for additional technical details.

Detection Methods for CVE-2025-68931

Indicators of Compromise

• Unusual patterns of decryption errors in Jenkins logs indicating potential padding oracle probing
• High volume of requests with modified encrypted payloads to Jervis-dependent endpoints
• Repeated failed decryption attempts followed by incremental ciphertext modifications
• Unexpected changes to encrypted configuration values or credentials

Detection Strategies

• Monitor Jenkins application logs for padding-related error messages that could indicate active exploitation attempts
• Implement anomaly detection for unusual patterns of cryptographic operation failures
• Review dependency inventories to identify Jervis library versions prior to 2.2
• Use software composition analysis (SCA) tools to flag vulnerable library versions in Jenkins deployments

Monitoring Recommendations

• Enable verbose logging for cryptographic operations in Jenkins environments
• Set up alerting for multiple consecutive decryption failures from the same source
• Monitor network traffic for patterns consistent with padding oracle attack attempts (repeated similar requests with slight variations)
• Regularly audit Jenkins plugin and library versions for known vulnerabilities

How to Mitigate CVE-2025-68931

Immediate Actions Required

• Upgrade Jervis library to version 2.2 or later immediately
• Review Jenkins configurations for any use of affected Jervis library versions
• Rotate any credentials or secrets that may have been encrypted using the vulnerable implementation
• Audit access logs for any suspicious decryption activity that may indicate prior exploitation

Patch Information

The vulnerability has been fixed in Jervis version 2.2. The fix implements proper authenticated encryption to prevent padding oracle attacks and ciphertext manipulation. The patch details can be reviewed in the GitHub commit c3981ff71de7b0f767dfe7b37a2372cb2a51974a. Organizations should update their Jervis library dependencies to the patched version as soon as possible.

Workarounds

• If immediate upgrade is not possible, consider isolating Jenkins instances using vulnerable Jervis versions from network access
• Implement additional network-layer encryption (TLS) to protect encrypted payloads in transit
• Avoid storing highly sensitive data using the vulnerable encryption mechanism until the upgrade is complete
• Monitor for exploitation attempts while planning the upgrade

# Upgrade Jervis library to patched version
# Update your build configuration (Gradle example)
# dependencies {
#     implementation 'net.gleske:jervis:2.2'
# }

# Verify current Jervis version in your Jenkins environment
grep -r "jervis" ~/.jenkins/plugins/ | grep -i version

# After upgrade, rotate any encrypted credentials
# Review Jenkins credential store and update affected secrets