Use of Password Hash With Insufficient Computational Effort Affecting org.apache.derby:derby package, versions [,

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    18 Dec 2010

  • disclosed

    16 Aug 2010

  • credit


How to fix?

Upgrade org.apache.derby:derby to version or higher.


org.apache.derby:derby is a database engine by Apache.

Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort. The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.