2.1

CVE-2009-4269: apache derby Cryptographic Issues

CVSS: 2.1v2.0LowModified
AliasesUBUNTU-CVE-2009-4269GHSA-fh32-35w2-rxcc
Published 16-08-2010Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2009-4269 is a low (CVSS 2.1) Cryptographic Issues vulnerability in apache derby. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.

Overall risk
9/100
0100
Minimal · default modelHow is this calculated?
CVSS score
2.1/10
010
Low · v2.0 (NVD)
EPSS score
1.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 16-08-2010
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

1.43%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
Org.apache.derby1 product
  • derby< 10.6.1.0
Ubuntu1 product
  • sun-javadbAll versions (No fix recorded)

3 vendors · 3 products

References

19 links
Show all 19 references