{"id":"CVE-2025-68704","state":"PUBLISHED","title":"Jervis has a Weak Random for Timing Attack Mitigation","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.","publishedAt":"2026-01-13T19:29:06.771Z","updatedAt":"2026-01-13T19:54:12.363Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["samrocketman jervis"],"affected":[{"vendor":"samrocketman","product":"jervis","versions":[{"version":"< 2.2","status":"affected"}]}],"references":["https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww","https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"],"weaknesses":["CWE-330"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68704.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68704","state":"PUBLISHED","datePublished":"2026-01-13T19:29:06.771Z","dateUpdated":"2026-01-13T19:54:12.363Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2025-12-23T22:32:51.733Z"},"containers":{"cna":{"title":"Jervis has a Weak Random for Timing Attack Mitigation","descriptions":[{"lang":"en","value":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2."}],"affected":[{"vendor":"samrocketman","product":"jervis","versions":[{"version":"< 2.2","status":"affected"}]}],"references":[{"url":"https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww","name":"https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","name":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-330","lang":"en","description":"CWE-330: Use of Insufficiently Random Values","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-01-13T19:29:06.771Z"},"source":{"advisory":"GHSA-c9q6-g3hr-8gww","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-13T19:54:07.357853Z","id":"CVE-2025-68704","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-13T19:54:12.363Z"}}]}}}