8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68704

CVE-2025-68704: Jervis has a Weak Random for Timing Attack Mitigation

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68704

CVE-2025-68704:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in the advisory, is the use of a weak random number generator for timing attack mitigation. The provided patch in commit c3981ff71de7b0f767dfe7b37a2372cb2a51974a directly addresses this issue. The analysis of the patch shows that the file src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy was modified. Specifically, the function avoidTimingAttack was changed to replace the usage of new Random() with SecureRandom.getInstance('NativePRNGNonBlocking'). java.util.Random is a predictable pseudo-random number generator, which makes the timing delays it generates predictable, thus defeating the purpose of the timing attack mitigation. java.security.SecureRandom is a cryptographically strong random number generator that produces non-deterministic output, making it suitable for security-sensitive applications like this. Therefore, the function net.gleske.jervis.tools.SecurityIO.avoidTimingAttack is the exact location of the vulnerability.

Vulnerable functions

net.gleske.jervis.tools.SecurityIO.avoidTimingAttack

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

The function `avoidTimingAttack` uses `java.util.Random` to generate a random delay. `java.util.Random` is not a cryptographically secure pseudorandom number generator. An attacker who can observe the timing of operations could potentially predict the random delays and bypass the timing attack mitigation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.