Listen to this Post
The vulnerability exists in the `SecurityIO.groovy` file of the Jervis project. When generating a hexadecimal string representation of a SHA-256 hash, the code incorrectly uses padLeft(32, '0'). A SHA-256 hash produces 32 bytes of binary data, which requires 64 hexadecimal characters (two hex chars per byte) for accurate representation. The incorrect padding to only 32 characters truncates the hash, resulting in an invalid, shortened hex string. This can cause critical failures in security-sensitive operations that rely on the integrity of the hash, such as artifact verification, signature validation, or access token generation. Any consumer application directly using the affected methods for comparison or validation will receive incorrect hash values, potentially leading to authentication bypass or data corruption by accepting mismatched files.
Platform: Jervis (Groovy library)
Version: < 2.2
Vulnerability: Incorrect Hash Padding
Severity: High
date: 2026-01-13
Prediction: Patch released 2026-01-13
What Undercode Say:
Vulnerable Code:
def hashHex = hashBytes.encodeHex().toString().padLeft(32, '0')
Patched Code:
def hashHex = hashBytes.encodeHex().toString().padLeft(64, '0')
Bash SHA-256:
echo -n "data" | sha256sum
Exploit:
Attackers could craft inputs causing hash collisions or bypass integrity checks due to truncated comparisons. Direct use of the flawed `getSha256Hex()` or `getSha256Hash()` methods allows exploitation.
Protection from this CVE
Upgrade to Jervis version 2.2 immediately. Alternatively, implement an external, verified SHA-256 hashing function for critical operations until the upgrade is complete.
Impact:
High severity for direct consumers of the library’s hash methods, potentially leading to authentication bypass or data integrity failure. Low severity for internal-only uses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
