{"id":"CVE-2025-68698","aliases":["GHSA-mqw7-c5gg-xq97"],"url":"https://o3.security/vulnerability/CVE-2025-68698","summary":"Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability","details":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497\n\nUses `PKCS1Encoding` which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding).\n\n### Impact\n\nSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.\n\nAn attacker with access to a decryption oracle (e.g., timing differences or error messages) could potentially decrypt ciphertext without knowing the private key.\n\nJervis uses RSA to encrypt AES keys in local-only storage inaccessible from the web.  The data stored is GitHub App authentication tokens which will expire within one hour or less.\n\n### Patches\n\nJervis patch will migrate from `PKCS1Encoding` to `OAEPEncoding`.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone\n\n### References\n\n- [Bleichenbacher's Attack on PKCS#1](https://en.wikipedia.org/wiki/Adaptive_chosen-ciphertext_attack)","published":"2026-01-13T19:16:01.757Z","modified":"2026-10-28T02:31:14.447957155Z","cvss":null,"epss":{"score":0.00133,"percentile":0.03298,"asOf":"2026-08-18"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"net.gleske:jervis","fixedVersion":"2.2"}],"fix":{"url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","label":"samrocketman/jervis@c3981ff"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68698.json"},{"type":"ADVISORY","url":"https://github.com/samrocketman/jervis/security/advisories/GHSA-mqw7-c5gg-xq97"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68698"},{"type":"FIX","url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"},{"type":"PACKAGE","url":"https://github.com/samrocketman/jervis"},{"type":"WEB","url":"https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465"},{"type":"WEB","url":"https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.447957155Z"}}