{"id":"GHSA-vrpq-qp53-qv56","summary":"Eclipse JGit XML External Entity (XXE) Vulnerability","details":"In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.","aliases":["CVE-2025-4949"],"modified":"2026-07-17T21:14:01.191907038Z","published":"2025-05-21T21:31:37Z","database_specific":{"cwe_ids":["CWE-611"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-05-22T18:49:33Z","nvd_published_at":"2025-05-21T07:16:01Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4949"},{"type":"PACKAGE","url":"https://github.com/eclipse-jgit/jgit"},{"type":"WEB","url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/64"},{"type":"WEB","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/5.13.5"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1"},{"type":"WEB","url":"https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"}],"affected":[{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0.202503040940-r"},{"fixed":"7.2.1.202505142326-r"}]}],"versions":["7.2.0.202503040940-r"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}},{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0.202411261347-r"},{"fixed":"7.1.1.202505221757-r"}]}],"versions":["7.1.0.202411261347-r"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}},{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.202409031743-r"},{"fixed":"7.0.1.202505221510-r"}]}],"versions":["7.0.0.202409031743-r"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}},{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0.202203080745-r"},{"fixed":"6.10.1.202505221210-r"}]}],"versions":["6.1.0.202203080745-r","6.10.0.202406032230-r","6.2.0.202206071550-r","6.3.0.202209071007-r","6.4.0.202211300538-r","6.5.0.202303070854-r","6.6.0.202305301015-r","6.6.1.202309021850-r","6.7.0.202309050840-r","6.8.0.202311291450-r","6.9.0.202403050737-r"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}},{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.202110060947-m1"},{"fixed":"6.0.0.202111291000-r"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}},{"package":{"name":"org.eclipse.jgit:org.eclipse.jgit","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jgit/org.eclipse.jgit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.4.202507202350-r"}]}],"versions":["1.2.0.201112221803-r","1.3.0.201202151440-r","2.0.0.201206130900-r","2.1.0.201209190230-r","2.2.0.201212191850-r","2.3.1.201302201838-r","3.0.0.201306101825-r","3.1.0.201310021548-r","3.2.0.201312181205-r","3.3.0.201403021825-r","3.3.1.201403241930-r","3.3.2.201404171909-r","3.4.0.201405051725-m7","3.4.0.201405211411-rc1","3.4.0.201405281120-rc2","3.4.0.201406041058-rc3","3.4.0.201406110918-r","3.4.1.201406201815-r","3.4.2.201412180340-r","3.5.0.201409071800-rc1","3.5.0.201409260305-r","3.5.1.201410131835-r","3.5.2.201411120430-r","3.5.3.201412180710-r","3.6.0.201411121045-m1","3.6.0.201412230720-r","3.6.1.201501031845-r","3.6.2.201501210735-r","3.7.0.201502260915-r","3.7.1.201504261725-r","4.0.0.201505050340-m2","4.0.0.201505260635-rc2","4.0.0.201506020755-rc3","4.0.0.201506090130-r","4.0.1.201506240215-r","4.0.2.201509141540-r","4.0.3.201509231615-r","4.1.0.201509280440-r","4.1.1.201511131810-r","4.1.2.201602141800-r","4.10.0.201712302008-r","4.11.0.201803080745-r","4.11.1.201807311124-r","4.11.2.201809100523-r","4.11.3.201809181037-r","4.11.4.201810060650-r","4.11.5.201810191925-r","4.11.6.201812241910-r","4.11.7.201903122105-r","4.11.8.201904181247-r","4.11.9.201909030838-r","4.2.0.201601211800-r","4.3.0.201604071810-r","4.3.1.201605051710-r","4.4.0.201605250940-rc1","4.4.0.201606070830-r","4.4.1.201607150455-r","4.5.0.201609210915-r","4.5.1.201703201650-r","4.5.2.201704071617-r","4.5.3.201708160445-r","4.5.4.201711221230-r","4.5.5.201812240535-r","4.5.6.201903121547-r","4.5.7.201904151645-r","4.6.0.201612231935-r","4.6.1.201703071140-r","4.7.0.201704051617-r","4.7.1.201706071930-r","4.7.2.201807261330-r","4.7.3.201809090215-r","4.7.4.201809180905-r","4.7.5.201810051826-r","4.7.6.201810191618-r","4.7.7.201812240805-r","4.7.8.201903121755-r","4.7.9.201904161809-r","4.8.0.201705170830-rc1","4.8.0.201706111038-r","4.9.0.201710071750-r","4.9.1.201712030800-r","4.9.10.201904181027-r","4.9.2.201712150930-r","4.9.3.201807311005-r","4.9.4.201809090327-r","4.9.5.201809180939-r","4.9.6.201810051924-r","4.9.7.201810191756-r","4.9.8.201812241815-r","4.9.9.201903122025-r","5.0.0.201805151920-m7","5.0.0.201805221745-rc1","5.0.0.201805301535-rc2","5.0.0.201806131550-r","5.0.1.201806211838-r","5.0.2.201807311906-r","5.0.3.201809091024-r","5.1.0.201809111528-r","5.1.1.201809181055-r","5.1.10.201908230655-r","5.1.11.201909031202-r","5.1.12.201910011832-r","5.1.13.202002110435-r","5.1.14.202011251942-r","5.1.15.202012011955-r","5.1.16.202106041830-r","5.1.2.201810061102-r","5.1.3.201810200350-r","5.1.5.201812261915-r","5.1.6.201903130242-r","5.1.7.201904200442-r","5.1.8.201906050907-r","5.1.9.201908210455-r","5.10.0.202012080955-r","5.11.0.202103091610-r","5.11.1.202105131744-r","5.12.0.202106070339-r","5.13.0.202109080827-r","5.13.1.202206130422-r","5.13.2.202306221912-r","5.13.3.202401111512-r","5.2.0.201812061821-r","5.2.1.201812262042-r","5.2.2.201904231744-r","5.3.0.201903130848-r","5.3.1.201904271842-r","5.3.2.201906051522-r","5.3.4.201908231101-r","5.3.5.201909031855-r","5.3.6.201910020505-r","5.3.7.202002110540-r","5.3.8.202011260953-r","5.3.9.202012012026-r","5.4.0.201906121030-r","5.4.2.201908231537-r","5.4.3.201909031940-r","5.5.0.201909110433-r","5.5.1.201910021850-r","5.6.0.201912101111-r","5.6.1.202002131546-r","5.7.0.202003090808-r","5.7.0.202003110725-r","5.8.0.202006091008-r","5.8.1.202007141445-r","5.9.0.202009080501-r"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}]}