Use of Password Hash With Insufficient Computational Effort Affecting org.apache.derby:derby Open this link in a new tab package, versions [10.5.3.0,10.6.1.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
18 Dec 2010
16 Aug 2010
How to fix?
org.apache.derby:derby to version 10.6.1.0 or higher.
org.apache.derby:derby is a database engine by Apache.
Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort. The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.