This advisory addresses two vulnerabilities (CVE-2025-4949 and CVE-2025-67635) found in Eclipse JGit used by Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16. The primary issue is an XML External Entity (XXE) vulnerability (CWE-611) that allows an attacker to cause local denial of service or information disclosure by submitting specially crafted XML files. The vulnerability resides in the experimental AmazonS3 transport class of JGit, which is not enabled by default and requires explicit configuration. Exploitation typically requires user interaction and is limited to client-side tools. The vulnerabilities can cause excessive resource consumption or unauthorized reading of local files. Red Hat rates this as a moderate severity issue and recommends upgrading to the latest image containing a newer OpenShift client (oc).

The vulnerabilities can lead to local denial of service through resource exhaustion or information disclosure by reading local files when processing malicious XML input. Due to the high attack complexity and requirement for user interaction, the risk of remote unauthenticated compromise is low. The primary impact is availability degradation on affected systems using the vulnerable JGit components with non-default configurations.

Red Hat recommends upgrading existing Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 installations to the latest available version which includes a newer OpenShift client bundled in the image. If Jenkins pipelines require a specific OpenShift client version, it should be explicitly configured in the pipeline tools directive. No other mitigations are specified by the vendor. Patch status is not explicitly confirmed in the advisory; users should verify the latest available updates from Red Hat.