The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Derby | Apache | * | 10.5.3.0 (including) |
| Sun-javadb | Ubuntu | esm-apps/xenial | * |
| Sun-javadb | Ubuntu | hardy | * |
| Sun-javadb | Ubuntu | jaunty | * |
| Sun-javadb | Ubuntu | karmic | * |
| Sun-javadb | Ubuntu | lucid | * |
| Sun-javadb | Ubuntu | maverick | * |
| Sun-javadb | Ubuntu | natty | * |
| Sun-javadb | Ubuntu | oneiric | * |
| Sun-javadb | Ubuntu | precise | * |
| Sun-javadb | Ubuntu | quantal | * |
| Sun-javadb | Ubuntu | raring | * |
| Sun-javadb | Ubuntu | saucy | * |
| Sun-javadb | Ubuntu | trusty | * |
| Sun-javadb | Ubuntu | upstream | * |
| Sun-javadb | Ubuntu | utopic | * |
| Sun-javadb | Ubuntu | vivid | * |
| Sun-javadb | Ubuntu | wily | * |
| Sun-javadb | Ubuntu | xenial | * |
| Sun-javadb | Ubuntu | yakkety | * |