CVE-2025-4949 is an XML External Entity (XXE) vulnerability found in Eclipse JGit, a component used by Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18. This flaw allows an attacker to cause local denial of service or information disclosure by submitting specially crafted XML files that exploit improper restriction of XML external entity references (CWE-611). The vulnerability resides in the experimental AmazonS3 transport class within JGit, which is not enabled by default and requires non-standard configuration, making exploitation complex and requiring user interaction. The vulnerability can lead to excessive resource consumption or reading of local files if exploited. Red Hat has released a security update recommending users upgrade to the latest OpenShift Jenkins 4.18 image, which includes a newer OpenShift client (oc) version. No explicit fix details or patches are provided in the advisory, but upgrading to the latest image is advised.

The vulnerability can cause local denial of service and potential information disclosure on affected systems running Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18. Exploitation complexity is high due to the need for non-default configuration and user interaction. The primary impact is availability degradation through resource exhaustion or local file disclosure via crafted XML input. There is no indication of remote, unauthenticated compromise under default configurations. No known exploits are reported in the wild.

Red Hat recommends upgrading existing installations of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 to the latest available version, which includes a newer OpenShift client (oc) bundled in the image. If Jenkins pipelines require a specific oc version, it should be explicitly configured in the pipeline tools directive. No other specific mitigations or temporary fixes are stated in the advisory. Patch status is not explicitly confirmed; users should follow Red Hat's advisory and update guidance.