1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-FH32-35W2-RXCC

[MAVEN:GHSA-FH32-35W2-RXCC] Use of Password Hash With Insufficient Computational Effort in Apache Derby

Severity Moderate
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages References Vulnerabilities

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Package Affected Version
pkg:maven/org.apache.derby/derby <= 10.5.3.01
Package Fixed Version
pkg:maven/org.apache.derby/derby = 10.6.1.0
ID
MAVEN:GHSA-FH32-35W2-RXCC
Severity
moderate
URL
https://github.com/advisories/GHSA-fh32-35w2-rxcc
Published
2022-05-02T03:53:13
(2 years ago)
Modified
2023-09-26T16:04:43
(11 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.apache.derby/derby org.apache.derby derby <= 10.5.3.01
Fixed pkg:maven/org.apache.derby/derby org.apache.derby derby = 10.6.1.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date