This advisory addresses a moderate severity vulnerability (CVE-2025-4949) found in Eclipse JGit used by Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15. The flaw is an XML External Entity (XXE) vulnerability that allows an attacker to cause local denial of service or information disclosure by submitting specially crafted XML files. The vulnerability resides in the experimental AmazonS3 transport class within JGit, which is not enabled by default and requires non-standard configuration, and exploitation requires user interaction. The advisory also references CVE-2025-67635 but does not detail it. The update includes a newer OpenShift client (oc) bundled in the image. No explicit fix version is stated, but users are advised to upgrade to the latest available version.

The vulnerability can lead to local denial of service and potential information disclosure on affected systems running OpenShift Jenkins 4.15 that utilize the vulnerable Eclipse JGit components. Due to the requirement for non-default configuration and user interaction, the risk of remote, unauthenticated exploitation is low. The primary impact is availability degradation (denial of service) and possible local file content exposure if exploited. There are no known exploits in the wild at this time.

Red Hat recommends that users of OpenShift Jenkins 4.15 upgrade to the latest available version of the OpenShift Developer Tools to address these vulnerabilities. The update includes a newer OpenShift client (oc) version bundled in the image. If Jenkins pipelines require a specific oc version, it should be explicitly configured in the pipeline tools directive. No other mitigations are specified in the advisory. Patch status is not explicitly confirmed; users should consult the Red Hat advisory RHSA-2025:23486 for the latest remediation guidance.