CVE-2022-46337 Apache Derby: LDAP injection vulnerability in authenticator

2023-11-2008:49:38

apache

www.cve.org

apache derby

ldap injection

authenticator

vulnerability

java 21

derby 10.17.1.0

data corruption

database security

10 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.3%

JSON

A cleverly devised username might bypass LDAP authentication checks. In
LDAP-authenticated Derby installations, this could let an attacker fill
up the disk by creating junk Derby databases. In LDAP-authenticated
Derby installations, this could also allow the attacker to execute
malware which was visible to and executable by the account which booted
the Derby server. In LDAP-protected databases which weren’t also
protected by SQL GRANT/REVOKE authorization, this vulnerability could
also let an attacker view and corrupt sensitive data and run sensitive
database functions and procedures.

Mitigation:

Users should upgrade to Java 21 and Derby 10.17.1.0.

Alternatively, users who wish to remain on older Java versions should
build their own Derby distribution from one of the release families to
which the fix was backported: 10.16, 10.15, and 10.14. Those are the
releases which correspond, respectively, with Java LTS versions 17, 11,
and 8.

CNA Affected

[
  {
    "collectionURL": "https://repo1.maven.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.derby",
    "product": "Apache Derby",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "10.1.3.1",
        "status": "affected",
        "version": "10.1.1.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.2.2.0",
        "status": "affected",
        "version": "10.2.1.6",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.3.3.0",
        "status": "affected",
        "version": "10.3.1.4",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.4.2.0",
        "status": "affected",
        "version": "10.4.1.3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.5.3.0",
        "status": "affected",
        "version": "10.5.1.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.6.2.1",
        "status": "affected",
        "version": "10.6.1.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.7.1.1"
      },
      {
        "lessThanOrEqual": "10.8.3.0",
        "status": "affected",
        "version": "10.8.1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.9.1.0"
      },
      {
        "lessThanOrEqual": "10.10.2.0",
        "status": "affected",
        "version": "10.10.1.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.11.1.1"
      },
      {
        "status": "affected",
        "version": "10.12.1.1"
      },
      {
        "status": "affected",
        "version": "10.13.1.1"
      },
      {
        "status": "affected",
        "version": "10.14.2.0"
      },
      {
        "lessThanOrEqual": "10.15.2.0",
        "status": "affected",
        "version": "10.15.1.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.16.1.1"
      }
    ]
  }
]