CVE-2009-4128

Name	CVE-2009-4128
Description	GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	555195

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
grub (PTS)	bullseye	0.97-77	fixed
	bookworm	0.97-80	fixed
	trixie	0.97-84	fixed
grub2 (PTS)	bullseye (security), bullseye	2.06-3~deb11u6	fixed
	bookworm, bookworm (security)	2.06-13+deb12u1	fixed
	forky, trixie	2.12-9	fixed
	sid	2.14~git20250718.0e36779-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
grub	source	(unstable)	(not affected)
grub2	source	lenny	(not affected)
grub2	source	(unstable)	1.97+20091115-1	555195

[lenny] - grub2 <not-affected> (Password authentication not yet present)
- grub <not-affected> (only affects grub2)