CVE-2025-68931: Jervis Package Vulnerability Due to AES CBC Mode Lacking Authentication
Summary
CVE-2025-68931: Jervis's AES CBC Mode is Without Authentication. Affects net.gleske:jervis versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jervis is an open-source library designed to facilitate GitHub App authentication and management. It leverages encryption to secure sensitive data, including authentication tokens. However, the library's implementation of AES in CBC mode without authentication exposes it to potential security risks, particularly in scenarios where the encrypted data is directly consumed by external users.
Vulnerability Detail
The vulnerability arises from the use of AES/CBC/PKCS5Padding for encryption, which lacks built-in authentication mechanisms. This deficiency makes it susceptible to padding oracle attacks and allows for potential ciphertext manipulation. Although the severity is considered low for internal uses, it becomes critical if external consumers directly utilize these methods. Jervis employs RSA for encrypting AES keys and uses a SHA-256 checksum to validate data integrity, which mitigates some risks, but the fundamental vulnerability remains.
How To Fix
Latest published version: 2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds for this vulnerability. The best course of action is to upgrade to the patched version of Jervis.
Conclusion
The Jervis package has a critical vulnerability due to its use of AES/CBC mode without authentication, which could expose sensitive data to attacks. Upgrading to version 2.2 is essential to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for net.gleske:jervis →
FAQ
The vulnerability is due to the use of AES/CBC/PKCS5Padding for encryption, which lacks authentication, making it vulnerable to attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
While there are no workarounds available, it is crucial to plan for an upgrade to the patched version as soon as possible.
Upgrading to version 2.2 involves changing the version number in your pom.xml file to ensure that the new, more secure encryption method is utilized.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.gleske:jervis.
