PT-2005-5510 · Apache · Apache Derby

Katherine Marsden · Publicado 2005-12-31 · Atualizado 2024-06-15 · CVE-2005-4849

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Derby versions prior to 10.1.2.1

Description: The issue exposes the user and password attributes in cleartext via the RDBNAM parameter of the ACCSEC command and the output of the DatabaseMetaData.getURL function, allowing attackers to obtain sensitive information.

Recommendations: For Apache Derby versions prior to 10.1.2.1, update to version 10.1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ACCSEC command and the DatabaseMetaData.getURL function to minimize the risk of exploitation. Avoid using the user and password attributes in cleartext until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2005-4849

GHSA-RP7R-79RM-2758

OPENSUSE-SU-2024:10092-1

Produtos afetados

Apache Derby

Referências · 15

• https://github.com/apache/derby · Nota
• https://github.com/apache/derby/commit/fd24a7590ff5426bac68303fbeca07dbc5067412 · Nota
• https://github.com/apache/derby/commit/09a7325f75a4f96a7735e46c9723930f88ea2613 · Nota
• https://github.com/apache/derby/commit/82d721fd53e30dbb86d6d742c085030985091968 · Nota
• https://osv.dev/vulnerability/GHSA-rp7r-79rm-2758 · Aviso do Fabricante
• http://issues.apache.org/jira/browse/DERBY-559 · Nota
• https://suse.com/security/cve/CVE-2015-1832 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4849 · Nota de Segurança
• https://suse.com/security/cve/CVE-2006-7216 · Nota
• http://db.apache.org/derby/releases/release-10.1.2.1.html · Correção
• https://suse.com/security/cve/CVE-2006-7217 · Nota
• http://svn.apache.org/viewvc?view=revision&revision=289672 · Nota
• http://issues.apache.org/jira/browse/DERBY-530 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10092-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2005-4849 · Nota