Description
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | derby | 10.13.1.1-1 | — |
| Debian 13 | derby | 10.13.1.1-1 | — |
| Debian 12 | derby | 10.13.1.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | derby | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | derby | 10.11.1.1-3.2 | openSUSE-SU-2024:10092-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.derby:derby | < 10.12.1.1 | 10.12.1.1 | GHSA-wr69-g62g-2r9h |
Advisories 2
- openSUSE-SU-2024:10092-1 derby-10.11.1.1-3.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1048 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2024
References
- 93132 vdb-entry
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://issues.apache.org/jira/browse/DERBY-6807
- http://www-01.ibm.com/support/docview.wss?uid=swg21990100
- https://svn.apache.org/viewvc?view=revision&revision=1691461