GHSA-fh32-35w2-rxcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-fh32-35w2-rxcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fh32-35w2-rxcc/GHSA-fh32-35w2-rxcc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fh32-35w2-rxcc
Aliases
  • CVE-2009-4269
Published
2022-05-02T03:53:13Z
Modified
2024-12-08T05:27:04.833334Z
Summary
Use of Password Hash With Insufficient Computational Effort in Apache Derby
Details

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Database specific 
{
    "nvd_published_at": "2010-08-16T20:00:00Z",
    "cwe_ids": [
        "CWE-916"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T22:23:08Z"
}
References

Affected packages

Maven / org.apache.derby:derby

Package

Name
org.apache.derby:derby
View open source insights on deps.dev
Purl
pkg:maven/org.apache.derby/derby

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.6.1.0

Affected versions

10.*

10.1.1.0
10.1.2.1
10.1.3.1
10.2.1.6
10.2.2.0
10.3.1.4
10.3.2.1
10.4.1.3
10.4.2.0
10.5.3.0
10.5.3.0_1

Database specific 

{
    "last_known_affected_version_range": "<= 10.5.3.01"
}