Weak Password Hashing in Apache Derby Database by Apache

CVE-2009-4269

Summary

Apache Derby prior to version 10.6.1.0 contains a vulnerability in its BUILTIN authentication mechanism. The password hash generation algorithm utilized by the system reduces the input size for the SHA-1 hashing process, leading to a restricted search space. This design flaw potentially allows attackers—both local and remote—to exploit the system by generating hash collisions. Consequently, it could enable unauthorized access through the effective cracking of passwords, particularly through password substitution techniques.

References