Skip to content

Commit 3aa31f4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-67rj-pjg6-pq59 GHSA-crxp-chh4-9ghp
1 parent 484aef9 commit 3aa31f4

2 files changed

Lines changed: 134 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-67rj-pjg6-pq59/GHSA-67rj-pjg6-pq59.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-67rj-pjg6-pq59",
4+
"modified": "2026-01-13T14:52:31Z",
5+
"published": "2026-01-13T14:52:31Z",
6+
"aliases": [
7+
"CVE-2025-68702"
8+
],
9+
"summary": "Jervis Has a SHA-256 Hex String Padding Bug",
10+
"details": "### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626\n\n`padLeft(32, '0')` should be `padLeft(64, '0')`. SHA-256 produces 32 bytes = 64 hex characters.\n\n### Impact\n\n* Inconsistent hash lengths when leading bytes are zero\n* Comparison failures for hashes with leading zeros\n* Potential security issues in hash-based comparisons\n* Could cause subtle bugs in systems relying on consistent hash lengths\n\nSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.\n\n### Patches\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nUse an alternate SHA-256 hash function or upgrade.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "net.gleske:jervis"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-67rj-pjg6-pq59"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/samrocketman/jervis"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-327"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-13T14:52:31Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/01/GHSA-crxp-chh4-9ghp/GHSA-crxp-chh4-9ghp.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-crxp-chh4-9ghp",
4+
"modified": "2026-01-13T14:51:58Z",
5+
"published": "2026-01-13T14:51:58Z",
6+
"aliases": [
7+
"CVE-2025-68701"
8+
],
9+
"summary": "Jervis has Deterministic AES IV Derivation from Passphrase",
10+
"details": "### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900\n\nSame passphrase + same plaintext = same ciphertext (IV reuse)\n\n### Impact\n\nSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.\n\nSignificant reduction in the security of the encryption scheme. Pattern analysis becomes possible.\n\n### Patches\n\nRandom IV will be generated and prepended to the ciphertext.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "net.gleske:jervis"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-crxp-chh4-9ghp"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/samrocketman/jervis"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-327"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-01-13T14:51:58Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)