CVE-2009-4269

Description

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Risk Information

Base Score

9.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score

Exploitation Probability

0.784

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2009-4269 are fixed in Apache-derby 10.6.1.0	Windows
Vulnerabilities CVE-2009-4269 are fixed in Apache-derby for Linux 10.6.1.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234