CVE-2025-4949VulnerabilityPublished 17 Dec 2025Updated 6 Sep 2026

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update

Affects Red HatSource GCVE Database

Mentioned vulnerabilities

CVE-2025-67635

Not known to be exploited.

Data as of 25 Oct 2026, 19:02 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hatredhat/openshift-developer-tools`pkg:rpm/redhat/openshift-developer-tools`Other threats	Affected =4.16	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat recommends upgrading existing Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 installations to the latest available version which includes a newer OpenShift client bundled in the image. If Jenkins pipelines require a specific OpenShift client version, it should be explicitly configured in the pipeline tools directive. No other mitigations are specified by the vendor. Patch status is not explicitly confirmed in the advisory; users should verify the latest available updates from Red Hat.

Description

Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.

Impact

The vulnerabilities can lead to local denial of service through resource exhaustion or information disclosure by reading local files when processing malicious XML input. Due to the high attack complexity and requirement for user interaction, the risk of remote unauthenticated compromise is low. The primary impact is availability degradation on affected systems using the vulnerable JGit components with non-default configurations.

Summary

This advisory addresses two vulnerabilities (CVE-2025-4949 and CVE-2025-67635) found in Eclipse JGit used by Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16. The primary issue is an XML External Entity (XXE) vulnerability (CWE-611) that allows an attacker to cause local denial of service or information disclosure by submitting specially crafted XML files. The vulnerability resides in the experimental AmazonS3 transport class of JGit, which is not enabled by default and requires explicit configuration. Exploitation typically requires user interaction and is limited to client-side tools. The vulnerabilities can cause excessive resource consumption or unauthorized reading of local files. Red Hat rates this as a moderate severity issue and recommends upgrading to the latest image containing a newer OpenShift client (oc).

CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
OWASP Cheat Sheets
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.5.2 (opens in a new tab)
Attack patterns
Data Serialization External Entities Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-459Incomplete Cleanup (opens in a new tab)
Base weakness
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Architecture and Design · Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Aug 2026, 18:40 UTC

WeaknessesCWE-611, CWE-459

Technical details

References

Community reviews

Related threats