ghsa-vrpq-qp53-qv56
Vulnerability from github
Published
2025-05-21 21:31
Modified
2025-05-23 16:26
Severity ?
6.8 (Medium) - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
Summary
Eclipse JGit XML External Entity (XXE) Vulnerability
Details

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jgit:org.eclipse.jgit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.0.202503040940-r"
            },
            {
              "fixed": "7.2.1.202505142326-r"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jgit:org.eclipse.jgit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0.202411261347-r"
            },
            {
              "fixed": "7.1.1.202505221757-r"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jgit:org.eclipse.jgit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0.202409031743-r"
            },
            {
              "fixed": "7.0.1.202505221510-r"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jgit:org.eclipse.jgit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.10.1.202505221210-r"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-4949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-22T18:49:33Z",
    "nvd_published_at": "2025-05-21T07:16:01Z",
    "severity": "MODERATE"
  },
  "details": "In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.",
  "id": "GHSA-vrpq-qp53-qv56",
  "modified": "2025-05-23T16:26:08Z",
  "published": "2025-05-21T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4949"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eclipse-jgit/jgit"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/64"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
    },
    {
      "type": "WEB",
      "url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1"
    },
    {
      "type": "WEB",
      "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1"
    },
    {
      "type": "WEB",
      "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1"
    },
    {
      "type": "WEB",
      "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Eclipse JGit XML External Entity (XXE) Vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.