XXE vulnerability in Eclipse JGit
Summary
XXE vulnerability in Eclipse JGit
Original description
The description as published by the source.
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-4949 jgit
- Ubuntu UBUNTU-CVE-2025-4949 jgit
References
- advisory github.com
- advisory nvd.nist.gov
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- package github.com
- report gitlab.eclipse.org
- report gitlab.eclipse.org
- web projects.eclipse.org
- web repo.maven.apache.org