XXE vulnerability in Eclipse JGit
概要
XXE vulnerability in Eclipse JGit
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-4949 jgit
- Ubuntu UBUNTU-CVE-2025-4949 jgit
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- package github.com
- report gitlab.eclipse.org
- report gitlab.eclipse.org
- web projects.eclipse.org
- web repo.maven.apache.org