Detections
Analytics
SCA: security update for com.aerospike:aerospike-client (GHSA-jj95-55cr-9597)
critical Tenable Self-Hosted Container Security Plugin ID 416417
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The Aerospike Java client is a Java application that implements a network protocol to communicate with an
Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the
server contain Java objects that the client deserializes when it encounters them without further
validation. Attackers that manage to trick clients into communicating with a malicious server can include
especially crafted objects in its responses that, once deserialized by the client, force it to execute
arbitrary code. This can be abused to take control of the machine the client is running on. Versions
7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue. (CVE-2023-36480)
See Also
Plugin Details
Severity: Critical
ID: 416417
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.58
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-36480
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/3/2023
Vulnerability Publication Date: 8/3/2023
Reference Information
CVE: CVE-2023-36480
cwe: CWE-502