PT-2026-2497 · Cloudbees+1 · Jenkins+1

CVE-2025-68704 · Publicado 2026-01-13 · Atualizado 2026-01-13

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, utilizes java.util.Random(), which is not cryptographically secure and may be susceptible to timing attacks. This impacts the security of random number generation within the library.

Recommendations Update to version 2.2 or later.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2025-68704

GHSA-C9Q6-G3HR-8GWW

Produtos afetados

Jenkins

Jervis

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68704.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Correção
• https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww · Correção
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594 · Nota
• https://github.com/samrocketman/jervis · Nota
• https://twitter.com/CVEnew/status/2011181482036117530 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-c9q6-g3hr-8gww · Aviso do Fabricante
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-68704 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-68704 · Aviso do Fabricante