CVE-2009-4269
Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Exploit likelihood
What each source reports
NVD Score used
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
CVE-2009-4269- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
CVE-2009-4269- Updated
- 2026-11-02
EUVDEUVD-2022-3779 No score
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
EUVD-2022-3779- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh32-35w2-rxcc No score
Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
GHSA-fh32-35w2-rxcc- Weakness
- CWE-916
- Updated
- 2026-11-02
OSVGHSA-fh32-35w2-rxcc No score
Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
GHSA-fh32-35w2-rxcc- Weakness
- CWE-916
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2009-4269 No score
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- Record
UBUNTU-CVE-2009-4269- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.derby:derbyMaven |
through 10.5.3.01 | 10.6.1.0 |
org.apache.derby:derbyMaven |
before 10.6.1.0, plus listed versions 10.1.1.010.1.2.110.1.3.110.2.1.610.2.2.0 Show 6 moreShow less10.3.1.410.3.2.110.4.1.310.4.2.010.5.3.010.5.3.0_1 |
10.6.1.0 |
sun-javadbUbuntu:16.04:LTS |
All versions, plus listed versions 10.3.2.1-0ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4269 is a low vulnerability (CVSS 2.1) in Apache Derby, published August 16, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in org.apache.derby:derby 10.6.1.0.
References
marc.info?l=apache-db-general&m=127428514905504&w=1
secunia.com/advisories/42948
issues.apache.org/jira/browse/DERBY-4483
blogs.sun.com/kah/entry/derby_10_6_1_has
vupen.com/english/advisories/2011/0149
Show 14 moreShow less
marcellmajor.com/derbyhash.html
securitytracker.com/id?1024977
db.apache.org/derby/releases/release-10.6.1.0.cgi
securityfocus.com/bid/42637
oracle.com/technetwork/topics/security/cpujan2011-194091.html
nvd.nist.gov/vuln/detail/CVE-2009-4269
github.com/apache/derby/commit/178ca0cfb796b5a5788d25ded0978773ea254332
ubuntu.com/security/CVE-2009-4269
cve.org/CVERecord?id=CVE-2009-4269