Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:21:29 +0000 EUVD-2026-265585 https://cve.radiocsirt.org/vuln/euvd-2026-265585 EUVD-2026-265585 https://cve.radiocsirt.org/vuln/euvd-2026-265585 fkie_cve-2025-68704 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68704 <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.</p> <p>Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68704 GHSA-c9q6-g3hr-8gww — Jervis Has Weak Random for Timing Attack Mitigation https://cve.radiocsirt.org/vuln/ghsa-c9q6-g3hr-8gww <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594</p> <p>Uses `java.util.Random()` which is not cryptographically secure.</p> <p>### Impact</p> <p>If an attacker can predict the random delays, they may still be able to perform timing attacks.</p> <p>### Patches</p> <p>Jervis will use `SecureRandom` for timing randomization.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)</p> <p><strong>Affected:</strong> Maven: net.gleske:jervis</p> <p>### Vulnerability</p> <p>https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594</p> <p>Uses `java.util.Random()` which is not cryptographically secure.</p> <p>### Impact</p> <p>If an attacker can predict the random delays, they may still be able to perform timing attacks.</p> <p>### Patches</p> <p>Jervis will use `SecureRandom` for timing randomization.</p> <p>Upgrade to Jervis 2.2.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)</p> https://cve.radiocsirt.org/vuln/ghsa-c9q6-g3hr-8gww