XML External Entity injection in JGit - CVE-2025-4949

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114059

XML External Entity injection in JGit - CVE-2025-4949

Published: August 14, 2025 / Updated: November 27, 2025


Vulnerability identifier: #VU114059
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-4949
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Affected software

JGit
OpenShift Developer Tools and Services
Red Hat Camel for Spring Boot
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Development Tools Module
openSUSE Leap
IBM Cloud Transformation Advisor
IBM Business Automation Manager Open Editions
DevOps Test Embedded for Eclipse
webMethods Integration Server
Oracle Data Integrator
Application Modernization Accelerator
JBoss Enterprise Application Platform
Oracle Fusion Middleware
Oracle Database Server
eap8-jboss-el (Red Hat package)
eap8-installation-manager-api (Red Hat package)
eap8-reactive-streams (Red Hat package)
eap8-parsson (Red Hat package)
eap8-bouncycastle (Red Hat package)
eap8-atinject (Red Hat package)
eap8-angus-activation (Red Hat package)
eap8-stax-ex (Red Hat package)
eap8-jakarta-interceptor-api (Red Hat package)
eap8-jakarta-annotation-api (Red Hat package)
eap8-wildfly-http-client (Red Hat package)
eap8-jakarta-activation (Red Hat package)
eap8-jakarta-mail (Red Hat package)
eap8-wildfly-elytron (Red Hat package)
eap8-reactivex-rxjava2 (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-enterprise-concurrent (Red Hat package)
eap8-jakarta-validation-api (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap8-yasson (Red Hat package)
eap8-jakarta-ws-rs-api (Red Hat package)
eap8-hal-console (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jakarta-xml-bind-api (Red Hat package)
eap8-jctools (Red Hat package)
eap8-sun-istack-commons (Red Hat package)
eap8-stax2-api (Red Hat package)
eap8-httpcomponents-core (Red Hat package)
eap8-httpcomponents-client (Red Hat package)
eap8-antlr4 (Red Hat package)
eap8-wildfly-clustering (Red Hat package)
eap8-jgroups (Red Hat package)
jgit
eclipse-jgit
eap8-jakarta-servlet-api (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-eclipse-jgit (Red Hat package)
eap8-hibernate-search (Red Hat package)
eap8-jbossws-cxf (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-wildfly-javadocs (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-infinispan (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)

How to mitigate CVE-2025-4949

Install updates from vendor's website.

JGit - update to 7.2.1.202505142326-r
IBM Cloud Transformation Advisor - update to 4.3.2
IBM Business Automation Manager Open Editions - update to 8.0.8
JBoss Enterprise Application Platform - addressed in versions 8.0.11, 8.1.2
webMethods Integration Server - update to 11.1 Fix 2
Oracle Database Server - update to 23.9.1
eap8-jboss-el (Red Hat package) - addressed in versions api_5.0_spec-4.0.2-1.Final_redhat_00001.1.el8eap, api_5.0_spec-4.0.2-1.Final_redhat_00001.1.el9eap
eap8-installation-manager-api (Red Hat package) - addressed in versions 1.0.3-1.Final_redhat_00001.1.el8eap, 1.0.3-1.Final_redhat_00001.1.el9eap
eap8-reactive-streams (Red Hat package) - addressed in versions 1.0.4-4.redhat_00005.1.el8eap, 1.0.4-4.redhat_00005.1.el9eap
eap8-parsson (Red Hat package) - addressed in versions 1.1.7-3.redhat_00003.1.el8eap, 1.1.7-3.redhat_00003.1.el9eap
eap8-bouncycastle (Red Hat package) - addressed in versions 1.82.0-1.redhat_00001.1.el8eap, 1.82.0-1.redhat_00001.1.el9eap
eap8-atinject (Red Hat package) - addressed in versions 2.0.1-5.redhat_00007.1.el8eap, 2.0.1-5.redhat_00007.1.el9eap
eap8-angus-activation (Red Hat package) - addressed in versions 2.0.2-2.redhat_00002.1.el8eap, 2.0.2-2.redhat_00002.1.el9eap
eap8-stax-ex (Red Hat package) - addressed in versions 2.1.0-3.redhat_00003.1.el8eap, 2.1.0-3.redhat_00003.1.el9eap
eap8-jakarta-interceptor-api (Red Hat package) - addressed in versions 2.1.0-5.redhat_00003.1.el8eap, 2.1.0-5.redhat_00003.1.el9eap
eap8-jakarta-annotation-api (Red Hat package) - addressed in versions 2.1.1-5.redhat_00005.1.el8eap, 2.1.1-5.redhat_00005.1.el9eap
eap8-wildfly-http-client (Red Hat package) - update to 2.1.3-1.Final_redhat_00001.1.el9eap
eap8-jakarta-activation (Red Hat package) - addressed in versions 2.1.3-2.redhat_00002.1.el8eap, 2.1.3-2.redhat_00002.1.el9eap
eap8-jakarta-mail (Red Hat package) - addressed in versions 2.1.3-3.redhat_00003.1.el8eap, 2.1.3-3.redhat_00003.1.el9eap
eap8-wildfly-elytron (Red Hat package) - addressed in versions 2.2.12-1.Final_redhat_00002.1.el8eap, 2.2.12-1.Final_redhat_00002.1.el9eap
eap8-reactivex-rxjava2 (Red Hat package) - addressed in versions 2.2.21-4.redhat_00003.1.el8eap, 2.2.21-4.redhat_00003.1.el9eap
eap8-snakeyaml (Red Hat package) - update to 2.3.0-1.redhat_00002.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.16.1-2.redhat_00002.1.el8eap, 2.16.1-2.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - update to 2.40.0-3.redhat_00008.1.el9eap
eap8-jakarta-enterprise-concurrent (Red Hat package) - addressed in versions 3.0.2-1.redhat_00001.1.el8eap, 3.0.2-1.redhat_00001.1.el9eap
eap8-jakarta-validation-api (Red Hat package) - addressed in versions 3.0.2-3.redhat_00006.1.el8eap, 3.0.2-3.redhat_00006.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-2.redhat_00002.1.el8eap, 3.0.4-2.redhat_00002.1.el9eap
eap8-yasson (Red Hat package) - addressed in versions 3.0.4-2.redhat_00004.1.el8eap, 3.0.4-2.redhat_00004.1.el9eap
eap8-jakarta-ws-rs-api (Red Hat package) - addressed in versions 3.1.0-5.redhat_00003.1.el8eap, 3.1.0-5.redhat_00003.1.el9eap
eap8-hal-console (Red Hat package) - addressed in versions 3.6.27-1.Final_redhat_00001.1.el8eap, 3.6.27-1.Final_redhat_00001.1.el9eap, 3.7.16-1.Final_redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - update to 3.18.0-2.redhat_00003.1.el9eap
eap8-jakarta-xml-bind-api (Red Hat package) - addressed in versions 4.0.2-2.redhat_00003.1.el8eap, 4.0.2-2.redhat_00003.1.el9eap
eap8-jctools (Red Hat package) - addressed in versions 4.0.5-3.redhat_00002.1.el8eap, 4.0.5-3.redhat_00002.1.el9eap
eap8-sun-istack-commons (Red Hat package) - addressed in versions 4.1.2-2.redhat_00003.1.el8eap, 4.1.2-2.redhat_00003.1.el9eap
eap8-stax2-api (Red Hat package) - addressed in versions 4.2.2-2.redhat_00003.1.el8eap, 4.2.2-2.redhat_00003.1.el9eap
Application Modernization Accelerator - update to 4.3.2
eap8-httpcomponents-core (Red Hat package) - addressed in versions 4.4.16-6.redhat_00011.1.el8eap, 4.4.16-6.redhat_00011.1.el9eap
eap8-httpcomponents-client (Red Hat package) - addressed in versions 4.5.14-5.redhat_00016.1.el8eap, 4.5.14-5.redhat_00016.1.el9eap
Red Hat Camel for Spring Boot - update to 4.10.7
eap8-antlr4 (Red Hat package) - update to 4.13.2-1.redhat_00001.1.el9eap
eap8-wildfly-clustering (Red Hat package) - update to 5.0.11-1.Final_redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - update to 5.3.21-1.Final_redhat_00001.1.el9eap
jgit - update to 5.11.0-150200.3.23.1
eclipse-jgit - update to 5.11.0-150200.3.23.1
eap8-jakarta-servlet-api (Red Hat package) - addressed in versions 6.0.0-6.redhat_00007.1.el8eap, 6.0.0-6.redhat_00007.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.46-1.Final_redhat_00001.1.el8eap, 6.2.46-1.Final_redhat_00001.1.el9eap, 6.6.31-1.Final_redhat_00001.1.el9eap
eap8-eclipse-jgit (Red Hat package) - addressed in versions 6.10.1.202505221210-1.r_redhat_00002.1.el8eap, 6.10.1.202505221210-1.r_redhat_00002.1.el9eap
eap8-hibernate-search (Red Hat package) - update to 7.2.4-1.Final_redhat_00001.1.el9eap
eap8-jbossws-cxf (Red Hat package) - addressed in versions 7.3.6-1.Final_redhat_00001.1.el8eap, 7.3.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.2-1.Final_redhat_00001.1.el8eap, 8.0.2-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.11-1.GA_redhat_00002.1.el8eap, 8.0.11-1.GA_redhat_00002.1.el9eap, 8.1.2-1.GA_redhat_00004.1.el9eap
eap8-wildfly-javadocs (Red Hat package) - update to 8.1.1-2.GA_redhat_00006.1.el9eap
eap8-objectweb-asm (Red Hat package) - update to 9.7.1-3.redhat_00002.1.el9eap
eap8-infinispan (Red Hat package) - update to 15.0.21-1.Final_redhat_00002.1.el9eap
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.11.0-1.GA_redhat_00001.1.el8eap, 800.11.0-1.GA_redhat_00001.1.el9eap, 801.2.0-1.GA_redhat_00001.1.el9eap

External References

Related Security Bulletins