This advisory covers a security update for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13, addressing CVE-2025-4949 and CVE-2025-67635. CVE-2025-4949 is an XML External Entity (XXE) vulnerability in Eclipse JGit's experimental AmazonS3 transport class, which is not enabled by default and requires non-standard configuration. Exploitation requires user interaction and can result in local denial of service and potential information disclosure by processing crafted XML files. The vulnerability is rated moderate by Red Hat and has an attack complexity classified as high. The update includes a newer OpenShift client (oc) version bundled in the image. Users should explicitly configure the oc version if required by their Jenkins pipelines. A patch is available for this issue.

The vulnerability allows an attacker to cause local denial of service and potentially disclose information by exploiting an XXE flaw in Eclipse JGit when parsing XML files. Exploitation requires user interaction and non-default configuration of the AmazonS3 transport class. The primary impact is local availability disruption rather than remote unauthenticated compromise. There are no known exploits in the wild. The vulnerability affects the OpenShift Jenkins 4.13 tooling used within Red Hat OpenShift Developer Tools.

A security update is available for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13. It is recommended that users upgrade to the latest version to mitigate this vulnerability. The update includes a newer OpenShift client (oc) version. If Jenkins pipelines require a specific oc version, it should be explicitly configured using the Jenkins pipeline tools directive. No additional mitigations are indicated by the vendor advisory.