CVE-2025-68704

CVE-2025-68704 describes a cryptographic weakness in the Jervis library, used by Jenkins Job DSL plugin scripts and shared pipeline libraries, prior to version 2.2. The vulnerability stems from its use of java.util.Random() for timing attack mitigation, which is not cryptographically secure. This allows for potential timing attacks that could lead to information disclosure (CVSS 7.5 High). While the vulnerability is easily exploitable over the network with low attack complexity, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.