Vulnerability Description
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aerospike | Aerospike Java Client | < 4.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/commit/02bf28e62fb186f004c82cPatch
- https://github.com/aerospike/aerospike-client-java/commit/51c65e32837da29435161aPatch
- https://github.com/aerospike/aerospike-client-java/commit/66aafb4cd743cf53baffaePatch
- https://github.com/aerospike/aerospike-client-java/commit/80c508cc5ecb0173ce92d7Patch
- https://github.com/aerospike/aerospike-client-java/security/advisories/GHSA-jj95Vendor Advisory
- https://support.aerospike.com/s/article/CVE-2023-36480-Aerospike-Java-Client-vulVendor Advisory
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910Product
FAQ
What is CVE-2023-36480?
CVE-2023-36480 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages receiv...
How severe is CVE-2023-36480?
CVE-2023-36480 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-36480?
Check the references section above for vendor advisories and patch information. Affected products include: Aerospike Aerospike Java Client.