https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:08:23.652228+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265585 EUVD-2026-265585 2026-10-06T22:08:23.700665+00:00 EUVD-2026-265585 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68704 fkie_cve-2025-68704 2026-10-06T22:08:23.700704+00:00

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

 https://cve.radiocsirt.org/vuln/ghsa-c9q6-g3hr-8gww GHSA-c9q6-g3hr-8gww — Jervis Has Weak Random for Timing Attack Mitigation 2026-10-06T22:08:23.700737+00:00

Affected: Maven: net.gleske:jervis

### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594

Uses `java.util.Random()` which is not cryptographically secure.

### Impact

If an attacker can predict the random delays, they may still be able to perform timing attacks.

### Patches

Jervis will use `SecureRandom` for timing randomization.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)