The Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 security update addresses CVE-2025-4949, a vulnerability in Eclipse JGit that allows XML External Entity (XXE) attacks via specially crafted XML files. This vulnerability affects the experimental AmazonS3 transport class within JGit, which is not enabled by default and requires non-standard configuration. Exploitation can cause local denial of service and potential information disclosure by processing malicious XML entities. The vulnerability has a moderate severity rating by Red Hat and requires user interaction for exploitation. The update includes a newer OpenShift client (oc) version bundled in the image and users should explicitly configure the oc version in Jenkins pipelines if needed. A patch is available for affected versions.

This vulnerability can lead to local denial of service and information disclosure on systems using the affected OpenShift Jenkins 4.12 tools with Eclipse JGit's experimental AmazonS3 transport enabled. The attack complexity is high and requires user interaction, limiting remote exploitation. There is no indication of known exploits in the wild. The primary impact is availability degradation locally and potential exposure of local files via crafted XML processing.

A security update is available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12. It is recommended that users upgrade to the latest patched version. The update includes a newer OpenShift client (oc) version. If Jenkins pipelines require a specific oc version, it should be explicitly configured using the Jenkins pipeline tools directive. No additional mitigations are indicated by the vendor advisory.