Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1a27eef3-717e-5c99-b40f-5165d33a59ec@apache.org>
Date: Sun, 19 Nov 2023 18:42:36 +0000
From: "Richard N. Hillegas" <rhillegas@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-46337: Apache Derby: LDAP injection vulnerability in
 authenticator 

Severity: low

Affected versions:

- Apache Derby 10.1.1.0 through 10.16.1.1

Description:

A cleverly devised username might bypass LDAP authentication checks. In 
LDAP-authenticated Derby installations, this could let an attacker fill 
up the disk by creating junk Derby databases. In LDAP-authenticated 
Derby installations, this could also allow the attacker to execute 
malware which was visible to and executable by the account which booted 
the Derby server. In LDAP-protected databases which weren't also 
protected by SQL GRANT/REVOKE authorization, this vulnerability could 
also let an attacker view and corrupt sensitive data and run sensitive 
database functions and procedures.

Mitigation:

Users should upgrade to Java 21 and Derby 10.17.1.0.

Alternatively, users who wish to remain on older Java versions should 
build their own Derby distribution from one of the release families to 
which the fix was backported: 10.16, 10.15, and 10.14. Those are the 
releases which correspond, respectively, with Java LTS versions 17, 11, 
and 8.

This issue is being tracked as DERBY-7147 

Credit:

This issue was discovered by 4ra1n and Y4tacker, who also proposed the fix. (finder)

References:

https://db.apache.org/
https://www.cve.org/CVERecord?id=CVE-2022-46337
https://issues.apache.org/jira/browse/DERBY-7147

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.