What is GHSA-crxp-chh4-9ghp?

GHSA-crxp-chh4-9ghp is a security advisory published by GitHub Security Advisories with High severity. Jervis has Deterministic AES IV Derivation from Passphrase

Which CVE IDs does GHSA-crxp-chh4-9ghp cover?

GHSA-crxp-chh4-9ghp covers the following CVE IDs: CVE-2025-68701. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crxp-chh4-9ghp?

GHSA-crxp-chh4-9ghp has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-crxp-chh4-9ghp?

GHSA-crxp-chh4-9ghp affects 1 product, including: maven/net.gleske:jervis:\u003c 2.2.

GHSA-crxp-chh4-9ghpHighCVSS 7.5

Jervis has Deterministic AES IV Derivation from Passphrase

Vendor

GitHub Security Advisories

Published

January 13, 2026

Last Modified

January 21, 2026

🔗 CVE IDs covered (1)

CVE-2025-68701 →

📋 Description

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900

Same passphrase + same plaintext = same ciphertext (IV reuse)

Impact

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.

Patches

Random IV will be generated and prepended to the ciphertext.

Upgrade to Jervis 2.2.

Workarounds

None

🎯 Affected products1

maven/net.gleske:jervis:< 2.2