Vulnerability · Published Aug 4, 2023 · Assigned by GitHub_M
CVE-2023-36480Aerospike Java Client vulnerable to unsafe deserialization of server responses
Critical 9.8
In plain English
A critical-severity unsafe deserialization in aerospike-client-java from aerospike. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.aerospike:aerospike-client | 6.2.0 | GHSA-jj95-55cr-9597 |
| Maven | com.aerospike:aerospike-client | 5.2.0 | GHSA-jj95-55cr-9597 |
| Maven | com.aerospike:aerospike-client | 4.5.0 | GHSA-jj95-55cr-9597 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aerospike | aerospike-client-java | >= 6.0.0, < 6.2.0>= 5.0.0, < 5.2.0< 4.5.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/aerospike/aerospike-client-java/security/advisories/GHSA-jj95-55cr-9597 x_refsource_CONFIRM
- https://github.com/aerospike/aerospike-client-java/commit/02bf28e62fb186f004c82c87b219db2fc5b8262a x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/commit/51c65e32837da29435161a2d9c09bbdc2071ecae x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/commit/66aafb4cd743cf53baffaeaf69b035f51d2e2e36 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/commit/80c508cc5ecb0173ce92d7fab8cfab5e77bd9900 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/AsyncRead.java#L68 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L1157 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L489 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L596 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/command/Buffer.java#L53 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/command/Command.java#L2083 x_refsource_MISC
- https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/util/Unpacker.java#L227 x_refsource_MISC
- https://support.aerospike.com/s/article/CVE-2023-36480-Aerospike-Java-Client-vulnerable-to-unsafe-deserialization-of-server-responses x_refsource_MISC