| Package | Affected versions | Patched versions |
|---|---|---|
| net.gleske:jervis | < 2.2 | 2.2 |
| jervis | < 2.2 | 2.2 |
Uses java.util.Random() which is not cryptographically secure.
If an attacker can predict the random delays, they may still be able to perform timing attacks.
Jervis will use SecureRandom for timing randomization.
Upgrade to Jervis 2.2.
None
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free