CVE-2025-4949 is an XML External Entity (XXE) vulnerability found in the Eclipse JGit library used by Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14. The flaw allows an attacker to cause local denial of service or information disclosure by submitting specially crafted XML files that exploit improper restriction of XML external entity references (CWE-611). The vulnerability resides in the experimental AmazonS3 transport class of JGit, which is not enabled by default and requires non-standard configuration, as well as user interaction for exploitation. The vulnerability can lead to resource exhaustion or reading of local files if exploited. Red Hat has released a security update for OpenShift Jenkins 4.14 to address this issue.

The vulnerability can cause local denial of service and potential information disclosure in affected Red Hat OpenShift Jenkins 4.14 environments. Exploitation requires user interaction and non-default configuration, limiting the risk of remote unauthenticated compromise. The impact includes resource consumption leading to denial of service and possible exposure of local files via crafted XML input. No known exploits are reported in the wild. The severity is rated medium by Red Hat.

A security update is available for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14. It is recommended that users upgrade to the latest patched version. The update includes a newer OpenShift client bundled in the image. If specific versions of the OpenShift client are required in Jenkins pipelines, they should be explicitly configured. No additional mitigations are specified by the vendor.