CVE-2009-4269
published 2010-08-16CVE-2009-4269: The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the…
PriorityP414low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
1.43%
70.0th percentile
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | derby | <= 10.5.3.0 | — |
| debian | derby | — | — |
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv2.1LOW
vendor_debian2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qrv7-cr6p-439g: Unspecified vulnerability in the Java DB component in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows local users to affect
ghsa_unreviewed·2022-05-17·CVSS 2.1
CVE-2010-4474 [LOW] GHSA-qrv7-cr6p-439g: Unspecified vulnerability in the Java DB component in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows local users to affect
Unspecified vulnerability in the Java DB component in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows local users to affect confidentiality via unknown vectors related to Security, a similar vulnerability to CVE-2009-4269.
OSV
Use of Password Hash With Insufficient Computational Effort in Apache Derby
osv·2022-05-02
CVE-2009-4269 [MEDIUM] Use of Password Hash With Insufficient Computational Effort in Apache Derby
Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
GHSA
Use of Password Hash With Insufficient Computational Effort in Apache Derby
ghsa·2022-05-02
CVE-2009-4269 [MEDIUM] CWE-916 Use of Password Hash With Insufficient Computational Effort in Apache Derby
Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
OSV
CVE-2009-4269: The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10
osv·2010-08-16·CVSS 2.1
CVE-2009-4269 [LOW] CVE-2009-4269: The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Debian
CVE-2009-4269: derby - The password hash generation algorithm in the BUILTIN authentication functionali...
vendor_debian·2009·CVSS 2.1
CVE-2009-4269 [LOW] CVE-2009-4269: derby - The password hash generation algorithm in the BUILTIN authentication functionali...
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://blogs.sun.com/kah/entry/derby_10_6_1_hashttp://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269http://marc.info/?l=apache-db-general&m=127428514905504&w=1http://marcellmajor.com/derbyhash.htmlhttp://secunia.com/advisories/42948http://secunia.com/advisories/42970http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.htmlhttp://www.securityfocus.com/bid/42637http://www.securitytracker.com/id?1024977http://www.vupen.com/english/advisories/2011/0149https://issues.apache.org/jira/browse/DERBY-4483http://blogs.sun.com/kah/entry/derby_10_6_1_hashttp://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269http://marc.info/?l=apache-db-general&m=127428514905504&w=1http://marcellmajor.com/derbyhash.htmlhttp://secunia.com/advisories/42948http://secunia.com/advisories/42970http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.htmlhttp://www.securityfocus.com/bid/42637http://www.securitytracker.com/id?1024977http://www.vupen.com/english/advisories/2011/0149https://issues.apache.org/jira/browse/DERBY-4483
2010-08-16
Published