CVE-2025-68704 json
Jervis has a Weak Random for Timing Attack Mitigation
published 9mo ago modified 4mo ago also GHSA-c9q6-g3hr-8gww , EUVD-2026-2024
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.
Patch / fix
- maven net.gleske:jervis 2.2
- samrocketman jervis 2.2
Is CVE-2025-68704 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.gleske:jervis | <2.2 |
2.2 |
Affected products
- samrocketman jervis
Classification
- Weakness
-
- CWE-330 Use of Insufficiently Random Values
References
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web, patch
-
github.com
/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww
web, patch, vendor-advisory
-
github.com
/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-68704
advisory
-
github.com
/samrocketman/jervis
package
-
github.com
/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/Sec
web
Sources
- CVE List CVE-2025-68704
- GitHub Advisory GHSA-c9q6-g3hr-8gww
- NVD CVE-2025-68704
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.