VDB
GHSA-rcjc-c4pj-xxrp
GHSA-rcjc-c4pj-xxrp
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Apache Derby: LDAP injection vulnerability in authenticator
Record from GitHub Advisory Database · Published November 20, 2023
derby is fixed in 10.17.1.0, 10.16.1.2, 10.15.2.1 and 10 more (Maven Central)
Apache Derby: LDAP injection vulnerability in authenticator
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.derby:derby | Maven Central | 10.17.1.0, 10.16.1.2, 10.15.2.1, 10.14.3, 10.14.2.1, 10.10.2.0, 10.8.3.0, 10.6.2.1, 10.5.3.0, 10.4.2.0, 10.3.3.0, 10.2.2.0, 10.1.3.1 |
| druid | Wolfi | 32.0.1-r1 |
| druid | Chainguard | 32.0.1-r1 |
| spark-4.1 | Wolfi | 4.1.1-r5 |
| spark-4.1 | Chainguard | 4.1.1-r5 |
| spark-fips-3.5 | Chainguard | 3.5.4-r17 |
| logstash-integration-jdbc | Wolfi | 5.4.8-r0 |
| spark-3.5 | Chainguard | 3.5.7-r2 |
| logstash-integration-jdbc | Chainguard | 5.4.8-r0 |
| hadoop-fips-3.3.6 | Chainguard | 3.3.6-r15 |
Risk scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | druid | 0 |
| chainguard | druid | 0 |
| wolfi | spark-4.1 | 0 |
| Maven | org.apache.derby:derby | 10.15.1.3, 10.10.1.1, 10.11.1.1 |
| chainguard | spark-4.1 | 0 |
| chainguard | spark-fips-3.5 | 0 |
| wolfi | logstash-integration-jdbc | 0 |
| chainguard | spark-3.5 | 0 |
| chainguard | logstash-integration-jdbc | 0 |
| chainguard | hadoop-fips-3.3.6 | 0 |
| chainguard | nacos-docker | * |
| chainguard | nacos | * |
Timeline
- Nov 20, 2023 CVE Published
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-rcjc-c4pj-xxrp
vulnetix vdb fixes GHSA-rcjc-c4pj-xxrpOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-rcjc-c4pj-xxrp/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart