{"id":"CVE-2025-68704","aliases":["GHSA-c9q6-g3hr-8gww"],"url":"https://o3.security/vulnerability/CVE-2025-68704","summary":"Jervis has a Weak Random for Timing Attack Mitigation","details":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594\n\nUses `java.util.Random()` which is not cryptographically secure.\n\n### Impact\n\nIf an attacker can predict the random delays, they may still be able to perform timing attacks.\n\n### Patches\n\nJervis will use `SecureRandom` for timing randomization.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone\n\n### References\n\n- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)","published":"2026-01-13T19:29:06.771Z","modified":"2026-08-12T03:51:19.437503412Z","cvss":null,"epss":{"score":0.00268,"percentile":0.19062,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"net.gleske:jervis","fixedVersion":"2.2"}],"fix":{"url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","label":"samrocketman/jervis@c3981ff"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68704.json"},{"type":"ADVISORY","url":"https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68704"},{"type":"FIX","url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"},{"type":"PACKAGE","url":"https://github.com/samrocketman/jervis"},{"type":"WEB","url":"https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594"},{"type":"WEB","url":"http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:19.437503412Z"}}