CVE-2025-4949 is a vulnerability in Eclipse JGit affecting Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19. It allows XML External Entity (XXE) attacks via specially crafted XML files, potentially causing local denial of service and information disclosure. The vulnerability resides in the experimental AmazonS3 transport class within JGit, which is not enabled by default and requires non-standard configuration. Exploitation requires user interaction and is primarily a local issue rather than a remote unauthenticated attack. The vulnerability is rated moderate by Red Hat and is associated with CWE-611 (Improper Restriction of XML External Entity Reference) and CWE-459. Red Hat recommends upgrading to the latest OpenShift Jenkins 4.19 image which includes a newer OpenShift client (oc). No explicit patch version is stated, but the advisory strongly recommends upgrading.

The vulnerability can lead to local denial of service and information disclosure on affected Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 installations that use the vulnerable Eclipse JGit component with the experimental AmazonS3 transport enabled. Exploitation requires user interaction and non-default configuration, limiting the risk primarily to local denial of service rather than remote unauthenticated compromise. There are no known exploits in the wild. The impact is rated moderate by Red Hat.

Red Hat recommends that existing users of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 upgrade to the latest available version which includes a newer OpenShift client (oc) bundled in the image. If Jenkins pipelines require a specific oc version, it should be explicitly configured using the Jenkins pipeline tools directive. No other specific mitigations are provided. Patch status is not explicitly confirmed; users should follow the Red Hat advisory RHSA-2025:23488 for updates and remediation guidance.