GHSA-fh32-35w2-rxcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-fh32-35w2-rxcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fh32-35w2-rxcc/GHSA-fh32-35w2-rxcc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fh32-35w2-rxcc
Aliases
  • CVE-2009-4269
Published
2022-05-02T03:53:13Z
Modified
2024-12-08T05:27:04Z
Summary
Use of Password Hash With Insufficient Computational Effort in Apache Derby
Details

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Database specific 
{
    "cwe_ids":  [
        "CWE-916"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-17T22:23:08Z",
    "nvd_published_at":  "2010-08-16T20:00:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.apache.derby:derby

Package

Name
org.apache.derby:derby
View open source insights on deps.dev
Purl
pkg:maven/org.apache.derby/derby

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.6.1.0

Affected versions

10.*
10.1.1.0
10.1.2.1
10.1.3.1
10.2.1.6
10.2.2.0
10.3.1.4
10.3.2.1
10.4.1.3
10.4.2.0
10.5.3.0
10.5.3.0_1

Database specific

last_known_affected_version_range 
"<= 10.5.3.01"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fh32-35w2-rxcc/GHSA-fh32-35w2-rxcc.json"