Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesnt validate that the JWT header specifies alg:RS256. This vulnerability is fixed in 2.2.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jervis | Samrocketman | * | 2.2 (excluding) |