Apache Derby: LDAP injection vulnerability in authenticator
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- The rating the maker of the software gives it. Shown when it differs from the CVSS level.What do these mean? →
- Low (apache)
- Fix
- Fixed in 10.14.2.1, 10.16.1.2, 10.15.2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- org.apache.derby
From 10.1.1.0 · through 10.1.3.1; From 10.2.1.6 · through 10.2.2.0; From 10.3.1.4 · through 10.3.3.0; From 10.4.1.3 · through 10.4.2.0; From 10.5.1.1 · through 10.5.3.0; From 10.6.1.0 · through 10.6.2.1; From 10.8.1.2 · through 10.8.3.0; From 10.10.1.1 · through 10.10.2.0; From 10.15.1.3 · through 10.15.2.0
- org.apache.derby:derbyMaven
From 10.1.1.0 · through 10.1.3.1
- org.apache.derby:derbyMaven
From 10.2.1.6 · through 10.2.2.0
- org.apache.derby:derbyMaven
From 10.3.1.4 · through 10.3.3.0
- org.apache.derby:derbyMaven
From 10.4.1.3 · through 10.4.2.0
- org.apache.derby:derbyMaven
From 10.5.1.1 · through 10.5.3.0
- org.apache.derby:derbyMaven
From 10.6.1.0 · through 10.6.2.1
- org.apache.derby:derbyMaven
10.7.1.1
- org.apache.derby:derbyMaven
From 10.8.1.2 · through 10.8.3.0
- org.apache.derby:derbyMaven
10.9.1.0
- org.apache.derby:derbyMaven
From 10.10.1.1 · through 10.10.2.0
- org.apache.derby:derbyMaven
10.11.1.1
- org.apache.derby:derbyMaven
10.12.1.1
- org.apache.derby:derbyMaven
10.13.1.1
- org.apache.derby:derbyMaven
From 10.14.2.0 · fixed in 10.14.2.1
- org.apache.derby:derbyMaven
From 10.16.1.1 · fixed in 10.16.1.2
- org.apache.derby:derbyMaven
From 10.15.1.3 · fixed in 10.15.2.1