This advisory announces a security update for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16, addressing two vulnerabilities tracked as CVE-2025-4949 and CVE-2025-67635. The update includes an updated OpenShift client (oc) version within the Jenkins image. The advisory does not provide detailed technical information about the nature of the vulnerabilities or explicit fixes but recommends upgrading to the latest version. The vulnerabilities are associated with CWEs 611 (Improper Restriction of XML External Entity Reference) and 459 (Incomplete Cleanup), indicating potential issues related to XML processing and resource cleanup. No known exploits in the wild have been reported.

The vulnerabilities affect Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 and may impact the security of Jenkins pipelines using this tooling. The medium severity rating suggests a moderate risk that could potentially allow attackers to exploit issues related to XML external entity processing or incomplete cleanup, possibly leading to information disclosure or resource misuse. However, no known exploits have been reported in the wild, and no detailed impact scenarios are provided.

Red Hat recommends that all users of OpenShift Developer Tools - Openshift Jenkins 4.16 upgrade to the latest available version which includes the updated OpenShift client (oc). If Jenkins pipelines require a specific oc version, users should explicitly configure it using the Jenkins pipeline tools directive. No other mitigation or temporary fixes are mentioned. Patch status is confirmed as available via the updated image provided by Red Hat.