{"id":"CVE-2025-68704","aliases":["EUVD-2026-2024","GHSA-c9q6-g3hr-8gww"],"status":"published","title":"Jervis has a Weak Random for Timing Attack Mitigation","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00274,"percentile":0.20002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2026-01-13T14:55:35Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Maven","package":"net.gleske:jervis","fixed_in":["2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.gleske:jervis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.gleske:jervis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.2","0.3","0.4","0.5","0.5.1","0.5.2","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7","2.0","2.0.1","2.1"]}],"products":[{"vendor":"samrocketman","product":"jervis"}],"references":[{"url":"https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594","tags":["web"]},{"url":"http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68704","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c9q6-g3hr-8gww"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68704.json","tags":["advisory"]},{"url":"https://github.com/samrocketman/jervis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-68704","title":"Jervis has a Weak Random for Timing Attack Mitigation","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:29:06.771Z","modified":"2026-01-13T19:54:12.363Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2026-2024","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:29:06Z","modified":"2026-01-13T19:54:12Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:52.739812Z"}],"ghsa":[{"id":"GHSA-c9q6-g3hr-8gww","title":"Jervis Has Weak Random for Timing Attack Mitigation","description":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594\n\nUses `java.util.Random()` which is not cryptographically secure.\n\n### Impact\n\nIf an attacker can predict the random delays, they may still be able to perform timing attacks.\n\n### Patches\n\nJervis will use `SecureRandom` for timing randomization.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone\n\n### References\n\n- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)","status":"published","published":"2026-01-13T14:55:35Z","modified":"2026-01-21T16:23:23Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2025-68704","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T20:16:07.673Z","modified":"2026-06-17T09:59:26.17Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-68704","title":"Jervis has a Weak Random for Timing Attack Mitigation","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:29:06.771Z","modified":"2026-10-28T02:31:13.703663056Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"GHSA-c9q6-g3hr-8gww","title":"Jervis Has Weak Random for Timing Attack Mitigation","description":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594\n\nUses `java.util.Random()` which is not cryptographically secure.\n\n### Impact\n\nIf an attacker can predict the random delays, they may still be able to perform timing attacks.\n\n### Patches\n\nJervis will use `SecureRandom` for timing randomization.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone\n\n### References\n\n- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)","status":"published","published":"2026-01-13T14:55:35Z","modified":"2026-02-03T03:11:38.690872Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}