CVE-2025-68704

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68704
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68704.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68704
Aliases
Published
2026-01-13T19:29:06.771Z
Modified
2026-03-01T02:55:21.809160Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jervis has a Weak Random for Timing Attack Mitigation
Details

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-330"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68704.json"
}
References

Affected packages

Git / github.com/samrocketman/jervis

Affected ranges

Type
GIT
Repo
https://github.com/samrocketman/jervis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2600d719c04c0450b86a0486b4676f3d5f24b7d4

Affected versions

jervis-0.*
jervis-0.1
jervis-0.10
jervis-0.11
jervis-0.12
jervis-0.13
jervis-0.2
jervis-0.3
jervis-0.4
jervis-0.5
jervis-0.5.1
jervis-0.5.2
jervis-0.6
jervis-0.7
jervis-0.8
jervis-0.9
jervis-1.*
jervis-1.0
jervis-1.1
jervis-1.2
jervis-1.3
jervis-1.4
jervis-1.5
jervis-1.6
jervis-1.7
jervis-2.*
jervis-2.0
jervis-2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68704.json"