samrocketman/jervis · Security
Jervis Has Weak Random for Timing Attack Mitigation
- GHSA ID
- GHSA-c9q6-g3hr-8gww
- CVE ID
- CVE-2025-68704
- Severity
- high
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 8.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Vulnerability
Uses java.util.Random() which is not cryptographically secure.
Impact
If an attacker can predict the random delays, they may still be able to perform timing attacks.
Patches
Jervis will use SecureRandom for timing randomization.
Upgrade to Jervis 2.2.
Workarounds
None
References
CWEs
- CWE-330 · Use of Insufficiently Random Values
References
- https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww ↗
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594 ↗
- http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-68704 ↗
- https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a ↗
- https://github.com/advisories/GHSA-c9q6-g3hr-8gww ↗