CVE-2023-36480: aerospike aerospike_java_client Deserialization of Untrusted Data
Vulnerability summary
CVE-2023-36480 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in aerospike aerospike_java_client. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities.
Timeline
- 04-08-2023PublishedVulnerability first disclosed.
- 17-10-2024Last modifiedVulnerability information updated.
Description
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.78%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Aerospike2 products
- aerospike_java_client< 4.5.0 | ≥ 5.0.0, < 5.2.0 | ≥ 6.0.0, < 6.2.0
- aerospike-client-java≥ 6.0.0, < 6.2.0 | ≥ 5.0.0, < 5.2.0 | < 4.5.0
Com.aerospike1 product
- aerospike-client≥ 6.0.0, < 6.2.0 | ≥ 5.0.0, < 5.2.0 | < 4.5.0
2 vendors · 3 products
References
15 links- github.com/aerospike/aerospike-client-java/security/advisories/GHSA-jj95-55cr-9597X Refsource CONFIRMWEBVendor Advisory
- github.com/aerospike/aerospike-client-java/commit/02bf28e62fb186f004c82c87b219db2fc5b8262aX Refsource MISCWEBPatch
- github.com/aerospike/aerospike-client-java/commit/51c65e32837da29435161a2d9c09bbdc2071ecaeX Refsource MISCWEBPatch
- github.com/aerospike/aerospike-client-java/commit/66aafb4cd743cf53baffaeaf69b035f51d2e2e36X Refsource MISCWEBPatch
- github.com/aerospike/aerospike-client-java/commit/80c508cc5ecb0173ce92d7fab8cfab5e77bd9900X Refsource MISCWEBPatch
