CVE-2025-4949 is an XML External Entity (XXE) vulnerability in Eclipse JGit used by Red Hat OpenShift Developer Tools - Openshift Jenkins. The vulnerability arises from improper restriction of XML external entity references (CWE-611) in JGit's ManifestParser or AmazonS3 transport class, which is experimental and not enabled by default. This flaw can be exploited by submitting specially crafted XML files to cause local denial of service or information disclosure. Exploitation complexity is high, requiring user interaction and non-standard configuration. Red Hat has released a security update in Openshift Jenkins 4.20 that includes a newer OpenShift client and mitigates this vulnerability.

The vulnerability allows an attacker to perform XML External Entity attacks that can lead to local denial of service by consuming excessive CPU or memory resources, or potentially disclose local file contents if the application echoes back XML data. The risk is limited due to the experimental nature of the affected component, the requirement for non-default configuration, and the need for user interaction. There are no known exploits in the wild. The impact is rated medium by Red Hat.

A security update is available in Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20. It is recommended that users upgrade to this version or later. The update includes a newer OpenShift client (oc) version bundled in the image. If Jenkins pipelines require a specific oc version, it should be explicitly configured in the pipeline tools directive. No additional mitigations are specified by the vendor.