PT-2026-2497 · Cloudbees+1 · Jenkins+1

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-68704

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, utilizes java.util.Random(), which is not cryptographically secure and may be susceptible to timing attacks. This impacts the security of random number generation within the library.

Recommendations Update to version 2.2 or later.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2025-68704

GHSA-C9Q6-G3HR-8GWW

Affected Products

Jenkins

Jervis

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68704.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Patch
• https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww · Patch
• https://osv.dev/vulnerability/GHSA-c9q6-g3hr-8gww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68704 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68704 · Vendor Advisory
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594 · Note
• https://github.com/samrocketman/jervis · Note
• https://twitter.com/CVEnew/status/2011181482036117530 · Twitter Post
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Note