high7.5

CVE-2025-68698

Jervis Has a RSA PKCS#1 Padding Vulnerability

Impact

### Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465 https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497 Uses `PKCS1Encoding` which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding). ### Impact Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical. An attacker with access to a decryption oracle (e.g., timing differences or error messages) could potentially decrypt ciphertext without knowing the private key. Jervis uses RSA to encrypt AES keys in local-only storage inaccessible from the web. The data stored is GitHub App authentication tokens which will expire within one hour or less. ### Patches Jervis patch will migrate from `PKCS1Encoding` to `OAEPEncoding`. Upgrade to Jervis 2.2. ### Workarounds None ### References - [Bleichenbacher's Attack on PKCS#1](https://en.wikipedia.org/wiki/Adaptive_chosen-ciphertext_attack)

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`net.gleske:jervis`	< 2.2	2.2

Affected products

Vendor	Product	Affected versions
Samrocketman	Jervis	before 2.2

Weakness classification

CWE-327