Skip to content

Deterministic AES IV Derivation from Passphrase

High
samrocketman published GHSA-crxp-chh4-9ghp Jan 13, 2026

Package

maven net.gleske:jervis (Maven)

Affected versions

< 2.2

Patched versions

2.2

Description

Vulnerability

static String encryptWithAES256(String passphrase, String data, Integer hash_iterations = DEFAULT_AES_ITERATIONS) {
// sha256Sum should always return lower case but forcing toLowerCase
// since this is used as an input for encryption and decryption.
String salt = sha256Sum(passphrase).toLowerCase()
byte[] b_secret = passwordKeyDerivation(passphrase, salt)
byte[] b_iv = salt.substring(0, 16).getBytes('UTF-8')
Integer iterations = (hash_iterations > 0) ? hash_iterations : 1
encodeBase64(encryptWithAES256(b_secret, b_iv, data, iterations))
}

static String decryptWithAES256(String passphrase, String data, Integer hash_iterations = DEFAULT_AES_ITERATIONS) {
// sha256Sum should always return lower case but forcing toLowerCase
// since this is used as an input for encryption and decryption.
String salt = sha256Sum(passphrase).toLowerCase()
byte[] b_secret = passwordKeyDerivation(passphrase, salt)
byte[] b_iv = salt.substring(0, 16).getBytes('UTF-8')
byte[] b_data = decodeBase64Bytes(data)
Integer iterations = (hash_iterations > 0) ? hash_iterations : 1
decryptWithAES256(b_secret, b_iv, b_data, iterations)
}

Same passphrase + same plaintext = same ciphertext (IV reuse)

Impact

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.

Patches

Random IV will be generated and prepended to the ciphertext.

Upgrade to Jervis 2.2.

Workarounds

None

Severity

High

CVE ID

CVE-2025-68701

Weaknesses

No CWEs