Login Request a demo
Unscored severity · published Aug 16, 2010
CVE-2009-4269
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Derby · Apache
through 10.5.3.0 · source: NVD
Affected product
DE
Derby
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4269
blogs.sun.com
http://blogs.sun.com/kah/entry/derby_10_6_1_has
db.apache.org
http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269
marc.info
http://marc.info/?l=apache-db-general&m=127428514905504&w=1
marcellmajor.com
http://marcellmajor.com/derbyhash.html
secunia.com
http://secunia.com/advisories/42948
secunia.com
http://secunia.com/advisories/42970
More from Derby
9.8
CVE-2022-46337
A cleverly devised username might bypass LDAP authentication checks
9.1
CVE-2015-1832
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers…
7.5
CVE-2010-2232
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file
5.3
CVE-2018-1313
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under…
–
CVE-2006-7217
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary…