# CVE-2022-46337: derby: A cleverly devised username might bypass LDAP authentication checks

CVE-2022-46337 is fixed in derby on 1 platform, first by DEBIAN-CVE-2022-46337, released November 20, 2023. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2022-46337
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0142
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 20, 2023

## Description

A cleverly devised username might bypass LDAP authentication checks. In  LDAP-authenticated Derby installations, this could let an attacker fill  up the disk by creating junk Derby databases. In LDAP-authenticated  Derby installations, this could also allow the attacker to execute  malware which was visible to and executable by the account which booted  the Derby server. In LDAP-protected databases which weren't also  protected by SQL GRANT/REVOKE authorization, this vulnerability could  also let an attacker view and corrupt sensitive data and run sensitive  database functions and procedures.  Mitigation:  Users should upgrade to Java 21 and Derby 10.17.1.0.  Alternatively, users who wish to remain on older Java versions should  build their own Derby distribution from one of the release families to  which the fix was backported: 10.16, 10.15, and 10.14. Those are the  releases which correspond, respectively, with Java LTS versions 17, 11,  and 8.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | derby Debian 13.5 (trixie) | 10.14.2.0-3 | [DEBIAN-CVE-2022-46337](https://patchblox.com/security/data/fix/linux/debian-cve-2022-46337.md) | Nov 20, 2023 |
| Linux | derby Debian 14 | 10.14.2.0-3 | [DEBIAN-CVE-2022-46337](https://patchblox.com/security/data/fix/linux/debian-cve-2022-46337.md) | Nov 20, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.