Red Hat Security Advisory

RHSA-2025:23490

Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.

Released 2025-12-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9

Fixes 2 records

TI-2025-04438 CVE-2025-4949 · GHSA-vrpq-qp53-qv56

XXE vulnerability in Eclipse JGit

MEDIUM 63

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git p…

CVSS 4.0MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00844 Published 2025-05-21 Partial fix · 7.2.1.202505142326-r, 7.1.1.202505221757-r +4 CWE-611

TI-2025-41378 CVE-2025-67635 · GHSA-9p56-p6mw-w8qc

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI…

MEDIUM 40

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2025-12-10 Fixed in 2.541, 2.528.3 CWE-404