CVE-2025-4949 is a vulnerability in Eclipse JGit used by Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 that allows XML External Entity (XXE) attacks via specially crafted XML files. This can cause local denial of service and information disclosure by exploiting the ManifestParser or AmazonS3 class for git transport. The vulnerability resides in the experimental AmazonS3 transport class, which is not enabled by default and requires non-standard configuration, limiting the attack complexity and requiring user interaction. The vulnerability is rated moderate by Red Hat and has no CVSS score assigned by the vendor, but NVD rates it as 4.8 with high attack complexity and required user interaction. Red Hat has released a security update to address this issue and recommends upgrading to the latest version of OpenShift Jenkins 4.17.

The vulnerability allows an attacker to perform XML External Entity (XXE) attacks that can lead to local denial of service and potential information disclosure on systems using the affected OpenShift Jenkins 4.17 tools. Exploitation requires user interaction and specific configuration enabling the experimental AmazonS3 transport class, limiting the risk primarily to local denial of service rather than remote unauthenticated compromise. The impact includes potential resource exhaustion and unauthorized file access if exploited.

A security update is available for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17. Users are strongly recommended to upgrade to the latest version to mitigate this vulnerability. If Jenkins pipelines require a specific OpenShift client (oc) version, it should be explicitly configured in the Jenkins pipeline tools directive. No additional mitigations are specified by Red Hat beyond applying the update.