Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS00Mnh3LXA2MngtaHdjZs3oxA

Improper Access Control in Apache Derby

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Permalink: https://github.com/advisories/GHSA-42xw-p62x-hwcf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00Mnh3LXA2MngtaHdjZs3oxA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-42xw-p62x-hwcf, CVE-2018-1313
References: Blast Radius: 23.0

Affected Packages

maven:org.apache.derby:derby
Dependent packages: 2,009
Dependent repositories: 22,059
Downloads:
Affected Version Ranges: >= 10.3.1.4, <= 10.14.1.0
Fixed in: 10.14.2.0
All affected versions:
All unaffected versions: