CVE-2025-68704

Jervis has a Weak Random for Timing Attack Mitigation

8.2 HighFix available

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.27%Up 0.2 points since Jan 14, 2026

What each source reports

CVE List Score used 8.2

Jervis has a Weak Random for Timing Attack Mitigation

Record: CVE-2025-68704
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-330
Updated: 2026-11-02

EUVDEUVD-2026-2024 8.2

Record: EUVD-2026-2024
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c9q6-g3hr-8gww 8.2

Jervis Has Weak Random for Timing Attack Mitigation

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594

Uses java.util.Random() which is not cryptographically secure.

Impact

If an attacker can predict the random delays, they may still be able to perform timing attacks.

Patches

Jervis will use SecureRandom for timing randomization.

Upgrade to Jervis 2.2.

Workarounds

None

References

OWASP Cryptographic Failures

Record: GHSA-c9q6-g3hr-8gww
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

NVD 8.2

Record: CVE-2025-68704
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

OSV 8.2

Jervis has a Weak Random for Timing Attack Mitigation

Record: CVE-2025-68704
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-330
Updated: 2026-11-02

OSVGHSA-c9q6-g3hr-8gww 8.2

Jervis Has Weak Random for Timing Attack Mitigation

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594

Uses java.util.Random() which is not cryptographically secure.

Impact

If an attacker can predict the random delays, they may still be able to perform timing attacks.

Patches

Jervis will use SecureRandom for timing randomization.

Upgrade to Jervis 2.2.

Workarounds

None

References

OWASP Cryptographic Failures

Record: GHSA-c9q6-g3hr-8gww
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

Affected products

samrocketman jervis

Affected packages

Affected packages
Package	Affected	Fixed
`net.gleske:jervis` Maven	before 2.2	2.2
`net.gleske:jervis` Maven	before 2.2, plus listed versions 0.10.100.110.120.13 Show 21 moreShow less 0.20.30.40.50.5.10.5.20.60.70.80.91.01.11.21.31.41.51.61.72.02.0.12.1	2.2

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-68704 is a high vulnerability (CVSS 8.2) in Samrocketman Jervis, published January 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in net.gleske:jervis 2.2.