CVE-2025-68701
High · 7.5Jervis has Deterministic AES IV Derivation from Passphrase
CVSS
7.5
EPSS
0.2%
Published
Jan 13, 2026
CISA due date
—
The record
Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high. Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.gleske:jervis | 0 | 2.2 |
Related vulnerabilities
- GHSA-crxp-chh4-9ghp Jervis has Deterministic AES IV Derivation from Passphrase Same vulnerability
- GHSA-gxp5-mv27-vjcj Jervis's AES CBC Mode is Without Authentication Also affects net.gleske:jervis
- GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability Also affects net.gleske:jervis
- GHSA-c9q6-g3hr-8gww Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis
- GHSA-36h5-vrq6-pp34 Jervis's Salt for PBKDF2 derived from password Also affects net.gleske:jervis
- GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug Also affects net.gleske:jervis
- GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability Also affects net.gleske:jervis
- CVE-2025-68704 Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis