CVE catalog

CVE-2009-4269

derby: CVE-2009-4269

Severity: Low
Published: Aug 16, 2010, 8:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.43% · Oct 25, 2026

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	derby	sid	`10.17.1.0-1`	not affected
Debian	derby	forky	`10.17.1.0-1`	not affected
Debian	derby	trixie	`10.14.2.0-3`	not affected
Debian	derby	bookworm	`10.14.2.0-2`	not affected
Ubuntu	sun-javadb	16.04	`10.3.2.1-0ubuntu2`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	derby	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	derby	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	derby	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	derby	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[derby-doc]Not affected
Source package: [derby]
Details (2)
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
[derby-tools]Not affected
Source package: [derby]
Details (2)
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
[libderbyclient-java]Not affected
Source package: [derby]
Details (2)
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
[libderby-java]Not affected
Source package: [derby]
Details (2)
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm
- 10.14.2.0-2 · all · bookworm
  Not affected
  dsa · derby · debian · bookworm

Observed: Oct 23, 2026, 5:04:44 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]