GHSA-vrpq-qp53-qv56

Source

https://github.com/advisories/GHSA-vrpq-qp53-qv56

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-vrpq-qp53-qv56/GHSA-vrpq-qp53-qv56.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrpq-qp53-qv56

Aliases

CVE-2025-4949

Related

Published

2025-05-21T21:31:37Z

Modified

2025-05-23T17:03:33.454724Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green CVSS Calculator

Summary

Eclipse JGit XML External Entity (XXE) Vulnerability

Details

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Database specific

{
    "nvd_published_at": "2025-05-21T07:16:01Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-22T18:49:33Z"
}

References

Affected packages

Maven / org.eclipse.jgit:org.eclipse.jgit

Package

Name: org.eclipse.jgit:org.eclipse.jgit; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.jgit/org.eclipse.jgit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.2.0.202503040940-r

Fixed

7.2.1.202505142326-r

Affected versions

7.*

7.2.0.202503040940-r

Maven / org.eclipse.jgit:org.eclipse.jgit

Package

Name: org.eclipse.jgit:org.eclipse.jgit; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.jgit/org.eclipse.jgit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.1.0.202411261347-r

Fixed

7.1.1.202505221757-r

Affected versions

7.*

7.1.0.202411261347-r

Maven / org.eclipse.jgit:org.eclipse.jgit

Package

Name: org.eclipse.jgit:org.eclipse.jgit; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.jgit/org.eclipse.jgit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0.202409031743-r

Fixed

7.0.1.202505221510-r

Affected versions

7.*

7.0.0.202409031743-r

Maven / org.eclipse.jgit:org.eclipse.jgit

Package

Name: org.eclipse.jgit:org.eclipse.jgit; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.jgit/org.eclipse.jgit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.10.1.202505221210-r

Affected versions

1.*

1.2.0.201112221803-r

1.3.0.201202151440-r

2.*

2.0.0.201206130900-r

2.1.0.201209190230-r

2.2.0.201212191850-r

2.3.1.201302201838-r

3.*

3.0.0.201306101825-r

3.1.0.201310021548-r

3.2.0.201312181205-r

3.3.0.201403021825-r

3.3.1.201403241930-r

3.3.2.201404171909-r

3.4.0.201405051725-m7

3.4.0.201405211411-rc1

3.4.0.201405281120-rc2

3.4.0.201406041058-rc3

3.4.0.201406110918-r

3.4.1.201406201815-r

3.4.2.201412180340-r

3.5.0.201409071800-rc1

3.5.0.201409260305-r

3.5.1.201410131835-r

3.5.2.201411120430-r

3.5.3.201412180710-r

3.6.0.201411121045-m1

3.6.0.201412230720-r

3.6.1.201501031845-r

3.6.2.201501210735-r

3.7.0.201502260915-r

3.7.1.201504261725-r

4.*

4.0.0.201505050340-m2

4.0.0.201505260635-rc2

4.0.0.201506020755-rc3

4.0.0.201506090130-r

4.0.1.201506240215-r

4.0.2.201509141540-r

4.0.3.201509231615-r

4.1.0.201509280440-r

4.1.1.201511131810-r

4.1.2.201602141800-r

4.2.0.201601211800-r

4.3.0.201604071810-r

4.3.1.201605051710-r

4.4.0.201605250940-rc1

4.4.0.201606070830-r

4.4.1.201607150455-r

4.5.0.201609210915-r

4.5.1.201703201650-r

4.5.2.201704071617-r

4.5.3.201708160445-r

4.5.4.201711221230-r

4.5.5.201812240535-r

4.5.6.201903121547-r

4.5.7.201904151645-r

4.6.0.201612231935-r

4.6.1.201703071140-r

4.7.0.201704051617-r

4.7.1.201706071930-r

4.7.2.201807261330-r

4.7.3.201809090215-r

4.7.4.201809180905-r

4.7.5.201810051826-r

4.7.6.201810191618-r

4.7.7.201812240805-r

4.7.8.201903121755-r

4.7.9.201904161809-r

4.8.0.201705170830-rc1

4.8.0.201706111038-r

4.9.0.201710071750-r

4.9.1.201712030800-r

4.9.2.201712150930-r

4.9.3.201807311005-r

4.9.4.201809090327-r

4.9.5.201809180939-r

4.9.6.201810051924-r

4.9.7.201810191756-r

4.9.8.201812241815-r

4.9.9.201903122025-r

4.9.10.201904181027-r

4.10.0.201712302008-r

4.11.0.201803080745-r

4.11.1.201807311124-r

4.11.2.201809100523-r

4.11.3.201809181037-r

4.11.4.201810060650-r

4.11.5.201810191925-r

4.11.6.201812241910-r

4.11.7.201903122105-r

4.11.8.201904181247-r

4.11.9.201909030838-r

5.*

5.0.0.201805151920-m7

5.0.0.201805221745-rc1

5.0.0.201805301535-rc2

5.0.0.201806131550-r

5.0.1.201806211838-r

5.0.2.201807311906-r

5.0.3.201809091024-r

5.1.0.201809111528-r

5.1.1.201809181055-r

5.1.2.201810061102-r

5.1.3.201810200350-r

5.1.5.201812261915-r

5.1.6.201903130242-r

5.1.7.201904200442-r

5.1.8.201906050907-r

5.1.9.201908210455-r

5.1.10.201908230655-r

5.1.11.201909031202-r

5.1.12.201910011832-r

5.1.13.202002110435-r

5.1.14.202011251942-r

5.1.15.202012011955-r

5.1.16.202106041830-r

5.2.0.201812061821-r

5.2.1.201812262042-r

5.2.2.201904231744-r

5.3.0.201903130848-r

5.3.1.201904271842-r

5.3.2.201906051522-r

5.3.4.201908231101-r

5.3.5.201909031855-r

5.3.6.201910020505-r

5.3.7.202002110540-r

5.3.8.202011260953-r

5.3.9.202012012026-r

5.4.0.201906121030-r

5.4.2.201908231537-r

5.4.3.201909031940-r

5.5.0.201909110433-r

5.5.1.201910021850-r

5.6.0.201912101111-r

5.6.1.202002131546-r

5.7.0.202003090808-r

5.7.0.202003110725-r

5.8.0.202006091008-r

5.8.1.202007141445-r

5.9.0.202009080501-r

5.10.0.202012080955-r

5.11.0.202103091610-r

5.11.1.202105131744-r

5.12.0.202106070339-r

5.13.0.202109080827-r

5.13.1.202206130422-r

5.13.2.202306221912-r

5.13.3.202401111512-r

6.*

6.0.0.202111291000-r

6.1.0.202203080745-r

6.2.0.202206071550-r

6.3.0.202209071007-r

6.4.0.202211300538-r

6.5.0.202303070854-r

6.6.0.202305301015-r

6.6.1.202309021850-r

6.7.0.202309050840-r

6.8.0.202311291450-r

6.9.0.202403050737-r

6.10.0.202406032230-r