CVE-2009-4269: Low severity Apache Derby vulnerability
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this Apache Derby vulnerability?
The vulnerability ID of this Apache Derby vulnerability is CVE-2009-4269.
What is the severity rating of CVE-2009-4269?
CVE-2009-4269 has a severity rating of 2.1, which is considered low.
How does CVE-2009-4269 impact Apache Derby?
CVE-2009-4269 allows a remote attacker to obtain sensitive information through a reduction in the size of the input set of the password hash generation algorithm.
Which versions of Apache Derby are affected by CVE-2009-4269?
Apache Derby versions up to and including 10.5.3.0 are affected by CVE-2009-4269.
How can I fix CVE-2009-4269?
To fix CVE-2009-4269, it is recommended to update Apache Derby to version 10.6.1.0 or later.