PT-2025-22326 · Eclipse+2 · Eclipse Jgit+2
Intrigus-Lgtm
+1
·
Published
2025-05-15
·
Updated
2026-01-05
·
CVE-2025-4949
CVSS v4.0
6.8
Medium
| Vector | AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Eclipse JGit versions 7.2.0.202503040940-r and older
Description
The ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This can lead to information disclosure, denial of service, and other security issues.
Recommendations
For Eclipse JGit versions 7.2.0.202503040940-r and older, consider disabling the
ManifestParser class and the AmazonS3 class until a patch is available. Restrict access to the experimental amazons3 git transport protocol to minimize the risk of exploitation. Avoid using the affected classes for parsing XML files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Eclipse Jgit
Suse