CVSS 4.0
8.2 highCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2025-68704
High (8.2) in samrocketman jervis. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in net.gleske:jervis 2.2.
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWE
- CWE-330
- Published
- Modified
- Record from
- the NVD, synced
Affected
- samrocketman:jervis
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c9q6-g3hr-8gww | Maven | net.gleske:jervis | <2.2 | 2.2 |