CVE-2025-68704 json
Jervis has a Weak Random for Timing Attack Mitigation
published 2026-01-13 9 mo ago modified 2026-06-17 4 mo ago also GHSA-c9q6-g3hr-8gww , EUVD-2026-2024
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.
Patch / fix
- maven net.gleske:jervis 2.2
- samrocketman jervis 2.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.gleske:jervis | <2.2 |
2.2 |
Affected products
- samrocketman jervis
Classification
- Weakness
-
- CWE-330 Use of Insufficiently Random Values
References
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web, patch
-
github.com
/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww
web, patch, vendor-advisory
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-68704
advisory
-
github.com
/samrocketman/jervis
package
-
github.com
/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/Sec
web
Sources
- CVE List CVE-2025-68704
- GitHub Advisory GHSA-c9q6-g3hr-8gww
- NVD CVE-2025-68704
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.