GHSA-fh32-35w2-rxcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-fh32-35w2-rxcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fh32-35w2-rxcc/GHSA-fh32-35w2-rxcc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fh32-35w2-rxcc
Aliases
  • CVE-2009-4269
Published
2022-05-02T03:53:13Z
Modified
2024-02-16T08:10:11.244059Z
Summary
Use of Password Hash With Insufficient Computational Effort in Apache Derby
Details

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

References

Affected packages

Maven / org.apache.derby:derby

Package

Name
org.apache.derby:derby
View open source insights on deps.dev
Purl
pkg:maven/org.apache.derby/derby

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.6.1.0

Affected versions

10.*

10.1.1.0
10.1.2.1
10.1.3.1
10.2.1.6
10.2.2.0
10.3.1.4
10.3.2.1
10.4.1.3
10.4.2.0
10.5.3.0
10.5.3.0_1

Database specific

{
    "last_known_affected_version_range": "<= 10.5.3.01"
}