Description
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | sun-javadb | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.derby:derby | < 10.6.1.0 | 10.6.1.0 | GHSA-fh32-35w2-rxcc |
Advisories 1
- WID-SEC-2023-0027 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2023
References
- [apache-db-general] 20100519 [ANNOUNCE] Apache Derby 10.6.1.0 released mailing-list
- 42948 third-party-advisory
- https://issues.apache.org/jira/browse/DERBY-4483
- http://blogs.sun.com/kah/entry/derby_10_6_1_has
- ADV-2011-0149 vdb-entry
- 42970 third-party-advisory
- http://marcellmajor.com/derbyhash.html
- 1024977 vdb-entry
- http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269
- 42637 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html