GHSA-crxp-chh4-9ghp

Jervis has Deterministic AES IV Derivation from Passphrase

Source: GitHub Advisory Database (reviewed) High CVE-2025-68701

Packages

Ecosystem	Package	Affected	Fixed in
Maven	net.gleske:jervis	< 2.2	2.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874 https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900 Same passphrase + same plaintext = same ciphertext (IV reuse) ### Impact Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high. Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible. ### Patches Random IV will be generated and prepended to the ciphertext. Upgrade to Jervis 2.2. ### Workarounds None

References

External links from the advisory. They lead to third-party sites.