samrocketman/jervis · Security
Jervis has Deterministic AES IV Derivation from Passphrase
- GHSA ID
- GHSA-crxp-chh4-9ghp
- CVE ID
- CVE-2025-68701
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Vulnerability
Same passphrase + same plaintext = same ciphertext (IV reuse)
Impact
Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.
Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.
Patches
Random IV will be generated and prepended to the ciphertext.
Upgrade to Jervis 2.2.
Workarounds
None
CWEs
- CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
References
- https://github.com/samrocketman/jervis/security/advisories/GHSA-crxp-chh4-9ghp ↗
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874 ↗
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900 ↗
- http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-68701 ↗
- https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a ↗
- https://github.com/advisories/GHSA-crxp-chh4-9ghp ↗