PT-2023-8191 · Apache+3 · Apache Derby+3

4Ra1N + 2 · Published 2023-11-19 · Updated 2025-06-10 · CVE-2022-46337

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Derby versions prior to 10.17.1.0

Description A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures.

Recommendations To resolve the issue, users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8.

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

BDU:2024-00180

CVE-2022-46337

GHSA-RCJC-C4PJ-XXRP

Affected Products

Apache Derby

Astra Linux

Debian

Red Os

References · 25

• https://safe-surf.ru/specialists/bulletins-nkcki/705873 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46337 · Security Note
• https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46337 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/701784 · Security Note
• https://ubuntu.com/security/CVE-2022-46337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-46337 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00180 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/706930 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-46337 · Security Note
• https://osv.dev/vulnerability/GHSA-rcjc-c4pj-xxrp · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://github.com/apache/derby · Note