Medium severity · published May 21, 2025
CVE-2025-4949
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JG
Jgit · Eclipse
before 5.13.4; 6.0.0 before 6.10.1.202505221210; 7.0.0 before 7.0.1.202505221510; 7.1.0 before 7.1.1.202505221757; 7.2.0 before 7.2.1.202505142326 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4949
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
Exploit
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1
More from Jgit
9.8
CVE-2014-9390
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode…
8.8
CVE-2023-4759
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used…