XXE vulnerability in Eclipse JGit
Résumé
XXE vulnerability in Eclipse JGit
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-4949 jgit
- Ubuntu UBUNTU-CVE-2025-4949 jgit
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- advisory projects.eclipse.org
- package github.com
- report gitlab.eclipse.org
- report gitlab.eclipse.org
- web projects.eclipse.org
- web repo.maven.apache.org