GHSA-c9q6-g3hr-8gwwHighCVSS 5.9
Jervis Has Weak Random for Timing Attack Mitigation
🔗 CVE IDs covered (1)
📋 Description
Vulnerability
https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594
Uses java.util.Random() which is not cryptographically secure.
Impact
If an attacker can predict the random delays, they may still be able to perform timing attacks.
Patches
Jervis will use SecureRandom for timing randomization.
Upgrade to Jervis 2.2.
Workarounds
None
References
🎯 Affected products1
- maven/net.gleske:jervis:< 2.2
🔗 References (6)
- https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594
- http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- https://nvd.nist.gov/vuln/detail/CVE-2025-68704
- https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- https://github.com/advisories/GHSA-c9q6-g3hr-8gww