high5.9
CVE-2025-68704
Jervis Has Weak Random for Timing Attack Mitigation
Impact
### Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594 Uses `java.util.Random()` which is not cryptographically secure. ### Impact If an attacker can predict the random delays, they may still be able to perform timing attacks. ### Patches Jervis will use `SecureRandom` for timing randomization. Upgrade to Jervis 2.2. ### Workarounds None ### References - [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.gleske:jervis | < 2.2 | 2.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Samrocketman | Jervis | before 2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww
- https://github.com/advisories/GHSA-c9q6-g3hr-8gww
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594
- http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- https://nvd.nist.gov/vuln/detail/CVE-2025-68704