CVE-2023-36480 Aerospike Java Client vulnerable to unsafe deserialization of server responses
Attackers can execute arbitrary code on client machines by tricking them into connecting to a malicious Aerospike server that sends crafted serialized objects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36480?
CVE-2023-36480 is a critical unsafe deserialization vulnerability in aerospike-client-java, published on 4 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
Weakness: CWE-502
Which versions are affected by CVE-2023-36480?
6 open source packages ship an affected version, including com.aerospike:aerospike-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.aerospike:aerospike-client Maven | All versions | 4.5.0 |
com.aerospike:aerospike-client Maven | All versions | 4.5.0 |
com.aerospike:aerospike-client Maven | From 5.0.0 | 5.2.0 |
com.aerospike:aerospike-client Maven | From 5.0.0 | 5.2.0 |
com.aerospike:aerospike-client Maven | From 6.0.0 | 6.2.0 |
com.aerospike:aerospike-client Maven | From 6.0.0 | 6.2.0 |
Products include Aerospike Aerospike Java Client.
How do I fix CVE-2023-36480?
Upgrade com.aerospike:aerospike-client to a fixed version for your release line: 4.5.0, 5.2.0 or 6.2.0.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-36480 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36480 exists.
Sources
Also known as GHSA-jj95-55cr-9597.