Skip to content

[JENKINS-25937] "Given final block not properly padded" after deleting master.key after Java security update #23658

Closed
Bug
Closed
[JENKINS-25937] "Given final block not properly padded" after deleting master.key after Java security update#23658
Bug
Labels
component:coreimported-jira-issuepriority:majorresolution:fixedsecurity

Description

@jenkins-infra-bot
jenkins-infra-bot
opened on Dec 5, 2014

Recently core tests have started failing:

https://jenkins.ci.cloudbees.com/job/core/job/jenkins-core-validated-merge/307/testReport/junit/jenkins.security/DefaultConfidentialStoreTest/roundtrip/

java.io.IOException: javax.crypto.BadPaddingException: Given final block not properly padded
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:811)
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:676)
	at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:313)
	at javax.crypto.Cipher.doFinal(Cipher.java:1970)
	at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:112)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:233)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:209)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1792)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1769)
	at org.apache.commons.io.IOUtils.copy(IOUtils.java:1744)
	at org.apache.commons.io.IOUtils.toByteArray(IOUtils.java:462)
	at jenkins.security.DefaultConfidentialStore.load(DefaultConfidentialStore.java:106)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite$PojoCachedMethodSiteNoUnwrapNoCoerce.invoke(PojoMetaMethodSite.java:230)
	at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite.call(PojoMetaMethodSite.java:53)
	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:42)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:108)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:116)
	at jenkins.security.DefaultConfidentialStoreTest.roundtrip(DefaultConfidentialStoreTest.groovy:52)

This is reproducible when the test is run on Java 8, but not 7. It looks like a real bug, not just a test failure; this part of the test checks what happens when master.key is deleted and recreated, which presumably is a rare event, so it is not surprising if this was never noticed by users.

Originally reported by jglick, imported from: "Given final block not properly padded" after deleting master.key after Java security update
  • assignee: jglick
  • status: Resolved
  • priority: Major
  • component(s): core
  • label(s): 1.580.3-fixed, security
  • resolution: Fixed
  • resolved: 2014-12-05T19:30:01+00:00
  • votes: 0
  • watchers: 4
  • imported: 2025-11-24
Raw content of original issue 
Recently core tests have started failing:



https://jenkins.ci.cloudbees.com/job/core/job/jenkins-core-validated-merge/307/testReport/junit/jenkins.security/DefaultConfidentialStoreTest/roundtrip/





java.io.IOException: javax.crypto.BadPaddingException: Given final block not properly padded
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:811)
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:676)
	at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:313)
	at javax.crypto.Cipher.doFinal(Cipher.java:1970)
	at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:112)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:233)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:209)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1792)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1769)
	at org.apache.commons.io.IOUtils.copy(IOUtils.java:1744)
	at org.apache.commons.io.IOUtils.toByteArray(IOUtils.java:462)
	at jenkins.security.DefaultConfidentialStore.load(DefaultConfidentialStore.java:106)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite$PojoCachedMethodSiteNoUnwrapNoCoerce.invoke(PojoMetaMethodSite.java:230)
	at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite.call(PojoMetaMethodSite.java:53)
	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:42)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:108)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:116)
	at jenkins.security.DefaultConfidentialStoreTest.roundtrip(DefaultConfidentialStoreTest.groovy:52)





This is reproducible when the test is run on Java 8, but not 7. It looks like a real bug, not just a test failure; this part of the test checks what happens when master.key is deleted and recreated, which presumably is a rare event, so it is not surprising if this was never noticed by users.

Activity

  1. jenkins-infra-bot commented on Dec 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 5, 2014
    Author
    jglick:

    CipherInputStream.getMoreData is rethrowing the BadPaddingException as an IOException, rather than ignoring it as the code used to do. This was introduced in http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/a132f7c497f8 which seems to be introduced as of jdk8u25-b01 though for some reason https://bugs.openjdk.java.net/browse/JDK-8037846 does not seem to be publicly available (perhaps it was a security vulnerability) and http://www.oracle.com/technetwork/java/javase/2col/8u25-bugfixes-2298227.html does not mention anything apparently related. https://bugs.openjdk.java.net/browse/JDK-8061619 appears to track the fact that this was a functional regression (and also implies that 7u71 is affected!), but it is closed without comment. https://bugzilla.redhat.com/show_bug.cgi?id=1151063 talks about CVE-2014-6558 and seems to have the most information.

  2. jenkins-infra-bot commented on Dec 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 5, 2014
    Author
    dogfood:
    • Original comment link
    • Raw content of original comment: 
      Integrated in  jenkins_main_trunk #3854
     [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue. (Revision 6318b8d800abdf8b280f4e1b8ce8bf22e49242ad)
      


           Result = SUCCESS
jesse glick : 6318b8d800abdf8b280f4e1b8ce8bf22e49242ad
Files : 
      

        
	
      • core/src/main/java/jenkins/security/DefaultConfidentialStore.java
        • 
	
      • changelog.html
        •

    Integrated in jenkins_main_trunk #3854
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue. (Revision 6318b8d)

    Result = SUCCESS
    jesse glick : 6318b8d800abdf8b280f4e1b8ce8bf22e49242ad
    Files :

    • core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    • changelog.html
  3. jenkins-infra-bot
    closed this as completedon Dec 5, 2014

  4. jenkins-infra-bot commented on Dec 17, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 17, 2014
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    changelog.html
    core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    http://jenkins-ci.org/commit/jenkins/6318b8d800abdf8b280f4e1b8ce8bf22e49242ad
    Log:
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue.

    Compare: a59cf9f...6318b8d

  5. jenkins-infra-bot commented on Dec 21, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 21, 2014
    Author
    olivergondza:
    • Original comment link
    • Raw content of original comment: 
      FTR: I observe the same test failure using OpenJDK 1.7.0_71.

    FTR: I observe the same test failure using OpenJDK 1.7.0_71.

  6. jenkins-infra-bot commented on Dec 21, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 21, 2014
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    http://jenkins-ci.org/commit/jenkins/5ded56a8288dfcfb9e389ea85edc13cf49981a2a
    Log:
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue.

    (cherry picked from commit 6318b8d)

    Conflicts:
    changelog.html

    Compare: 23e0d6a...5ded56a

  7. jenkins-infra-bot commented on Feb 28, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 28, 2015
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    changelog.html
    core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    http://jenkins-ci.org/commit/jenkins/16afb73b254504d0f0f1246e34cce1fb5bd65c35
    Log:
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue.

    (cherry picked from commit 6318b8d)

  8. jenkins-infra-bot commented on Feb 28, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 28, 2015
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    changelog.html
    core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    http://jenkins-ci.org/commit/jenkins/16afb73b254504d0f0f1246e34cce1fb5bd65c35
    Log:
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue.

    (cherry picked from commit 6318b8d)

  9. jenkins-infra-bot commented on Feb 28, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 28, 2015
    Author
    dogfood:
    • Original comment link
    • Raw content of original comment: 
      Integrated in  jenkins_main_trunk #3989
     [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue. (Revision 16afb73b254504d0f0f1246e34cce1fb5bd65c35)
      


           Result = SUCCESS
jesse glick : 16afb73b254504d0f0f1246e34cce1fb5bd65c35
Files : 
      

        
	
      • core/src/main/java/jenkins/security/DefaultConfidentialStore.java
        • 
	
      • changelog.html
        •

    Integrated in jenkins_main_trunk #3989
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue. (Revision 16afb73)

    Result = SUCCESS
    jesse glick : 16afb73b254504d0f0f1246e34cce1fb5bd65c35
    Files :

    • core/src/main/java/jenkins/security/DefaultConfidentialStore.java
    • changelog.html

  10. jenkins-infra-bot commented on Sep 24, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Sep 24, 2015
    Author
    dogfood:

    Integrated in jenkins_main_trunk #4292
    [FIXED JENKINS-25937] Treat BadPaddingException as an unloadable key and continue. (Revision 5ded56a)

    Result = UNSTABLE
    ogondza : 5ded56a8288dfcfb9e389ea85edc13cf49981a2a
    Files :

    • core/src/main/java/jenkins/security/DefaultConfidentialStore.java
  11. jenkins-infra-bot
    added
    bugFor changelog: Minor bug. Will be listed after features
    security
    imported-jira-issue
    component:core
    priority:major
    resolution:fixed
    and removed
    bugFor changelog: Minor bug. Will be listed after features
    on Nov 24, 2025
  12. jenkins-infra-bot
    added the
    Bug
    issue type on Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:coreimported-jira-issuepriority:majorresolution:fixedsecurity

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions