PT-2010-1340 · Apache · Apache Derby

Marcell Major · Published 2010-08-16 · Updated 2022-05-02 · CVE-2009-4269

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Derby versions prior to 10.6.1.0

Description The issue concerns the password hash generation algorithm in the BUILTIN authentication functionality. It performs a transformation that reduces the size of the set of inputs to SHA-1, resulting in a small search space. This makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Recommendations For versions prior to 10.6.1.0, update to version 10.6.1.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-916

CWE-310

Related Identifiers

CVE-2009-4269

GHSA-FH32-35W2-RXCC

Affected Products

Apache Derby

References · 21

• https://ubuntu.com/security/CVE-2009-4269 · Vendor Advisory
• https://issues.apache.org/jira/browse/DERBY-4483 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh32-35w2-rxcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4269 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-4269 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-4269 · Security Note
• https://github.com/apache/derby/commit/178ca0cfb796b5a5788d25ded0978773ea254332 · Note
• https://github.com/apache/derby/commit/8c305e2f3fad1c3a4f98c06c7f2b53e2bfdd308c · Note
• https://github.com/apache/derby/commit/23f97a597716ee5b08eff698b7177850ad8e1294 · Note
• https://github.com/apache/derby/commit/60edeb0cb29daf9d28ece1863db779c1af5a3f62 · Note
• https://github.com/apache/derby/commit/3b82686e32a8d4fa2027350279104f9b243b35d6 · Note
• http://secunia.com/advisories/42948 · Note
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Note
• http://securityfocus.com/bid/42637 · Note
• http://marc.info/?l=apache-db-general&m=127428514905504&w=1 · Note