CVE-2018-1313

Description

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

5.3

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.71% Top 30%

Third-Party Advisory markmail.org Third-Party Advisory oracle.com

Affected: Apache Software Foundation Apache Derby

References

Link	Tags
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	third party advisory patch
https://markmail.org/message/akkappppxcdqrgxk	mailing list third party advisory mitigation
http://www.securityfocus.com/bid/104140	vdb entry broken link
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	mailing list
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	mailing list
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E	mailing list
https://lists.apache.org/thread.html/re29ab90978e6c997377fb975f674f7514f6beb642bbf79deb45477e5%40%3Cdev.hive.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r437d94437e6aef31af689b1e7025d024d676fd1ea9901d74e3e9ae48%40%3Cissues.hive.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r6755f48d4f5e44e39bba7dbf8d746678239d7f1f2cc108125519ce53%40%3Cissues.hive.apache.org%3E	mailing list

Frequently Asked Questions

What is the severity of CVE-2018-1313?: CVE-2018-1313 has been scored as a medium severity vulnerability.
How to fix CVE-2018-1313?: To fix CVE-2018-1313, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2018-1313 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2018-1313 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2018-1313?: CVE-2018-1313 affects Apache Software Foundation Apache Derby.