CVE-2022-46337: Apache Derby LDAP Injection Vulnerability
Summary
CVE-2022-46337: Apache Derby: LDAP injection vulnerability in authenticator. Affects org.apache.derby:derby across 4 version ranges.
>= 10.1.1.0, < 10.14.3
>= 10.15.0.0, < 10.15.2.1
>= 10.16.0.0, < 10.16.1.2
>= 10.17.0.0, < 10.17.1.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- derby · Debian:11
The same CVE-2022-46337 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Derby is an open-source relational database management system implemented entirely in Java. It provides a small footprint, yet fully functional database engine that can be embedded into Java applications or run as a standalone server. The LDAP authentication feature in Apache Derby allows users to authenticate against an LDAP server. However, a vulnerability has been discovered in the authenticator of Apache Derby, which could be exploited by an attacker to bypass LDAP authentication checks and perform various malicious activities.
Vulnerability Detail
The LDAP injection vulnerability in Apache Derby's authenticator allows an attacker to craft a username that can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this vulnerability can lead to disk space exhaustion by creating junk Derby databases. Additionally, an attacker can execute malware that is visible to and executable by the account that booted the Derby server. In LDAP-protected databases without SQL GRANT/REVOKE authorization, the vulnerability enables an attacker to view and corrupt sensitive data, as well as run sensitive database functions and procedures.
How To Fix
Latest published version: 10.17.1.0 as of 22 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.1.1.0, < 10.14.310.14.3 -
>= 10.15.0.0, < 10.15.2.110.15.2.1 -
>= 10.16.0.0, < 10.16.1.210.16.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix or upgrade as soon as possible.
Conclusion
The LDAP injection vulnerability in Apache Derby's authenticator poses a significant risk to LDAP-authenticated Derby installations. It allows attackers to bypass authentication checks, potentially leading to disk space exhaustion, execution of malware, and unauthorized access to sensitive data. Upgrading to the recommended versions or building a patched distribution is crucial to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.derby:derby →
FAQ
Apache Derby is an open-source relational database management system implemented entirely in Java. It provides a small footprint, yet fully functional database engine that can be embedded into Java applications or run as a standalone server.
LDAP authentication in Apache Derby allows users to authenticate against an LDAP server. It provides an additional layer of security for Derby installations.
An LDAP injection vulnerability occurs when user-supplied input is not properly sanitized and is directly used in LDAP queries. This can allow an attacker to manipulate LDAP queries and potentially bypass authentication or perform unauthorized actions.
The consequences of this vulnerability include disk space exhaustion, execution of malware, unauthorized access to sensitive data, and the ability to run sensitive database functions and procedures.
To mitigate this vulnerability, it is recommended to upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users on older Java versions can build their own Derby distribution from the backported releases. It is important to follow the official documentation for the upgrade or build process.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.derby:derby.
