The password hash generation algorithm in the BUILTIN authentication functionality for…
Priority LOW 14CWE-310Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Why it matters now
EPSS 0.01426 73rd percentileScored 2026-11-07
Fix Fixed org.apache.derby:derby (Maven): 10.6.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.derby:derby (Maven) | before 10.6.1.0 | 10.6.1.0 | Patch available | GHSA-fh32-35w2-rxcc |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.derby:derby (Maven) Vendor— Affected before 10.6.1.0 Fixed in 10.6.1.0 Patch available GHSA-fh32-35w2-rxcc
Remediation
- Fix · GHSA-fh32-35w2-rxcc org.apache.derby:derby (Maven) Fixed in 10.6.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2009-4269
- 2026-10-03 Alias added: GHSA-fh32-35w2-rxcc
References
Advisory 2
Other 11
- [apache-db-general] 20100519 [ANNOUNCE] Apache Derby 10.6.1.0 released
- http://blogs.sun.com/kah/entry/derby_10_6_1_has
- ADV-2011-0149
- http://marcellmajor.com/derbyhash.html
- http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
- https://github.com/apache/derby/commit/178ca0cfb796b5a5788d25ded0978773ea254332
- https://github.com/apache/derby/commit/23f97a597716ee5b08eff698b7177850ad8e1294
- https://github.com/apache/derby/commit/3b82686e32a8d4fa2027350279104f9b243b35d6
- https://github.com/apache/derby/commit/60edeb0cb29daf9d28ece1863db779c1af5a3f62
- https://github.com/apache/derby/commit/8c305e2f3fad1c3a4f98c06c7f2b53e2bfdd308c
More Apache Derby vulnerabilities
- TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
- TI-2022-22882 Apache Derby: LDAP injection vulnerability in authenticator CVSS 3.1CRITICAL 9.8
- TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
- TI-2018-01216 Improper access control in Apache Derby CVSS 3.1MEDIUM 5.3
- TI-2005-04579 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in… CVSS 2.0MEDIUM 5.0
- TI-2006-06958 Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the… CVSS 2.0MEDIUM 4.0
Sources
- CVE-2009-4269 · CVE Program
- CVE-2009-4269 · NVD
- FIRST EPSS
- GHSA-fh32-35w2-rxcc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences