Critical, CVSS 9.8MavenPublished
Aerospike Java Client vulnerable to unsafe deserialization of server responses
CVE-2023-36480 · GHSA-jj95-55cr-9597
- Affected
- Maven com.aerospike:aerospike-client >= 6.0.0, < 6.2.0; >= 5.0.0, < 5.2.0; < 4.5.0
- Fixed in
- 4.5.05.2.06.2.0· Vendor fix available
- Issue
- GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-044 The GitHub Security Lab team has identified a potential security vulnerability in Aerospike Java Client. We are committed to working with you to help resolve this issue. In this report you will find everything you need to effectively coordinate a resolution of this issue with the GHSL team. If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at securitylab@github.com (please include GHSL-2023-044 as a reference). If you are NOT the correct point of contact for this report, please let us know! Summary The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include…
Recommended action: Upgrade to 6.2.0, 5.2.0 or 4.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.