Homepage
About Snyk

Use of Password Hash With Insufficient Computational Effort Affecting org.apache.derby:derby package, versions [10.5.3.0,10.6.1.0)

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.15% (51st percentile)
Expand this section
NVD
4 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHEDERBY-30019
  • published 18 Dec 2010
  • disclosed 16 Aug 2010
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 16 Aug 2010

CVE-2009-4269 Open this link in a new tab
CWE-916 Open this link in a new tab

How to fix?

Upgrade org.apache.derby:derby to version 10.6.1.0 or higher.

Overview

org.apache.derby:derby is a database engine by Apache.

Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort. The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.