CVE-2023-36480

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-36480
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-36480.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-36480
Aliases
Published
2023-08-04T14:29:34.806Z
Modified
2025-11-15T06:40:33.489446Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Aerospike Java Client vulnerable to unsafe deserialization of server responses
Details

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ]
}
References

Affected packages

Git / github.com/aerospike/aerospike-client-java

Affected ranges

Type
GIT
Repo
https://github.com/aerospike/aerospike-client-java
Events
Introduced
30be5e0366a66edc78339d9e01232fc2f42722c1
Fixed
561b53a0cf1bb35393d0113c2016707464ca9472
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/aerospike/aerospike-client-java
Events
Introduced
2b91cfbe532761cff9b89fe948c749282bcd63bd
Fixed
861d16892220ac0eb1cf5e201338e86da8a0642f
Database specific 
{
    "versions": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.2.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/aerospike/aerospike-client-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
17de60227f7d454a3542764d2829a0f6fdec8fe3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.5.0"
        }
    ]
}

Affected versions

2.*

2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.14
2.1.15
2.1.16
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0

3.*

3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.2
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
3.0.27
3.0.28
3.0.29
3.0.3
3.0.30
3.0.31
3.0.32
3.0.33
3.0.34
3.0.35
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.1.0
4.1.1
4.1.10
4.1.11
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.4.0
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9

5.*

5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.1.0
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9

6.*

6.0.0
6.0.1
6.1.0
6.1.1
6.1.10
6.1.11
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9