CVE-2025-68704

Jervis has a Weak Random for Timing Attack Mitigation

8.2 HighFix available

CVE-2025-68704 is a high vulnerability (CVSS 8.2) in Samrocketman Jervis, published January 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 20th percentile. Fixed in net.gleske:jervis 2.2.

What does this mean?

Severity: 8.2 HighCVSS 4.0, CVE List
Exploit chance: 0.27%EPSS, 20th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.2net.gleske:jervis +1 more

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.27%Up 0.2 points since Jan 14, 2026

Affected products

samrocketman jervis

Affected packages

Affected packages
Package	Affected	Fixed
`net.gleske:jervis` Maven	before 2.2	2.2
`net.gleske:jervis` Maven	before 2.2, plus listed versions 0.10.100.110.120.13 Show 21 moreShow less 0.20.30.40.50.5.10.5.20.60.70.80.91.01.11.21.31.41.51.61.72.02.0.12.1	2.2

What each source reports

CVE List Score used8.2

Jervis has a Weak Random for Timing Attack Mitigation

Record: CVE-2025-68704
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-330
Updated: 2026-11-02

EUVDEUVD-2026-20248.2

Record: EUVD-2026-2024
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c9q6-g3hr-8gww8.2

Jervis Has Weak Random for Timing Attack Mitigation

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594

Uses java.util.Random() which is not cryptographically secure.

Impact

If an attacker can predict the random delays, they may still be able to perform timing attacks.

Patches

Jervis will use SecureRandom for timing randomization.

Upgrade to Jervis 2.2.

Workarounds

None

References

OWASP Cryptographic Failures

Record: GHSA-c9q6-g3hr-8gww
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

NVD8.2

Record: CVE-2025-68704
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

OSV8.2