Improper access control in Apache Derby
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Derby | 10.3.1.4 to 10.14.1.0 | — | No fix listed | CNA |
| — | org.apache.derby:derby (Maven) | 10.3.1.4 to before 10.14.2.0 | 10.14.2.0 | Patch available | GHSA-42xw-p62x-hwcf |
- Apache Derby VendorApache Affected 10.3.1.4 to 10.14.1.0 Fixed in — No fix listed CNA
- org.apache.derby:derby (Maven) Vendor— Affected 10.3.1.4 to before 10.14.2.0 Fixed in 10.14.2.0 Patch available GHSA-42xw-p62x-hwcf
Remediation
- Fix · GHSA-42xw-p62x-hwcf org.apache.derby:derby (Maven) Fixed in 10.14.2.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
Not affected: 6 products
- Red Hat BPM Suite 6
- Red Hat Fuse 7
- Red Hat JBoss BRMS 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1313
- 2026-10-03 Alias added: GHSA-42xw-p62x-hwcf
References
Advisory 2
Other 12
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [hive-dev] 20211007 [jira] [Created] (HIVE-25597) Bump Apache Derby 10.14.1.0 to 10.14.2.0 CVE-2018-1313
- [hive-issues] 20211007 [jira] [Assigned] (HIVE-25597) Bump Apache Derby 10.14.1.0 to 10.14.2.0 CVE-2018-1313
- [hive-issues] 20211007 [jira] [Commented] (HIVE-25597) Bump Apache Derby 10.14.1.0 to 10.14.2.0 CVE-2018-1313
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r437d94437e6aef31af689b1e7025d024d676fd1ea9901d74e3e9ae48@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r6755f48d4f5e44e39bba7dbf8d746678239d7f1f2cc108125519ce53@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/re29ab90978e6c997377fb975f674f7514f6beb642bbf79deb45477e5@%3Cdev.hive.apache.org%3E
More Apache Derby vulnerabilities
- TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
- TI-2022-22882 Apache Derby: LDAP injection vulnerability in authenticator CVSS 3.1CRITICAL 9.8
- TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
- TI-2005-04579 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in… CVSS 2.0MEDIUM 5.0
- TI-2006-06958 Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the… CVSS 2.0MEDIUM 4.0
- TI-2006-06957 Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table… CVSS 2.0MEDIUM 4.0
Sources
- CVE-2018-1313 · CVE Program
- CVE-2018-1313 · NVD
- FIRST EPSS
- GHSA-42xw-p62x-hwcf · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1313 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences