CVE-2025-68704: 
Java vulnerability analysis and mitigation

CVE-2025-68704 is a weak random number generation vulnerability in Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to version 2.2, the avoidTimingAttack() method in SecurityIO.groovy uses java.util.Random() — a non-cryptographically secure PRNG — instead of SecureRandom, undermining its intended timing attack mitigation. The vulnerability affects all Jervis versions before 2.2 (Maven artifact net.gleske:jervis) and was disclosed on January 13, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory).

The root cause is classified as CWE-330 (Use of Insufficiently Random Values). The vulnerable code is located in src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy at lines 593–594, where the avoidTimingAttack() static method computes a random delay using new Random().nextInt(milliseconds * -1) (GitHub Advisory). Because java.util.Random is a linear congruential generator with a predictable seed, an attacker with network access and the ability to observe response timing can statistically predict the generated delay values, negating the constant-time protection the function is designed to provide. The fix replaces java.util.Random with SecureRandom (cryptographically secure PRNG) in Jervis 2.2 (Patch Commit).

Successful exploitation could allow a network-accessible attacker to conduct timing attacks against Jenkins Job DSL implementations that rely on Jervis for security-sensitive operations, potentially compromising confidential information such as secrets, tokens, or credentials processed by the library (GitHub Advisory). The impact is limited to confidentiality (no integrity or availability impact), but in CI/CD environments where Jervis handles GitHub App authentication tokens or encrypted pipeline secrets, a successful timing attack could expose sensitive credentials and enable lateral movement within the Jenkins infrastructure (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, reflecting a very low probability of near-term exploitation. Exploitation requires an attacker to have network access and the ability to make repeated, measurable requests to a Jervis-protected endpoint, then statistically analyze timing variations — a non-trivial but feasible attack for a determined adversary.

Upgrade Jervis to version 2.2 or later, which replaces java.util.Random with SecureRandom in the avoidTimingAttack() method (Patch Commit). No workarounds are available for versions prior to 2.2 (GitHub Advisory). Organizations using the Maven artifact net.gleske:jervis in Job DSL plugin scripts or shared Jenkins pipeline libraries should update their dependency to net.gleske:jervis:2.2 (or later, with 2.4 being the latest release as of mid-2026) and rebuild their Jenkins configurations.

The vulnerability received limited public attention, consistent with its niche scope. A brief mention appeared on Mastodon (infosec.exchange) shortly after disclosure, and the advisory was indexed by several vulnerability aggregators including Vulners, VulDB, and CIRCL (Feedly). Red Hat also tracked the CVE in their security advisory system. No significant vendor statements beyond the original GitHub Security Advisory from the maintainer were identified.