Use of Password Hash With Insufficient Computational Effort Affecting org.apache.derby:derby package, versions [10.5.3.0,10.6.1.0)


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGAPACHEDERBY-30019

  • published

    18 Dec 2010

  • disclosed

    16 Aug 2010

  • credit

    Unknown

How to fix?

Upgrade org.apache.derby:derby to version 10.6.1.0 or higher.

Overview

org.apache.derby:derby is a database engine by Apache.

Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort. The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.