LoginSign Up
← Back to all sparks
A

Aerospike

DEVOPS
Velocity0.0

Real time distributed NoSQL database for high throughput workloads

aerospike.com ↗

Aerospike's 8.0 branch picks up three more CVE fixes two months after the July train.

nosql databasecve remediationmsgpackbackportscommunity edition
◆Current state
Aerospike Community Edition maintains 7.1, 7.2, 8.0 and 8.1 branches. On 16 July it published seven releases in under two hours carrying two waves of security fixes across all four. In September 8.0.0.20 added three more CVE fixes (msgpack bounds checks in UDFs, a zero-length list element crash and a heap overflow in persisted lists and maps) along with cold-start set-membership and recluster fixes.
◆Where it's heading
msgpack parsing and collection data types keep producing memory-safety bugs across both the July and September releases. 8.0.0.19 does not appear in the feed, and no 8.1 or 7.x counterpart to 8.0.0.20 has shown up yet.
◆Prediction
If the July pattern holds, matching 8.1 and 7.2 releases with the same three CVE fixes should follow.

◆Recent moves

  1. 1mo ago

    Aerospike 8.0.0.20 fixes three msgpack and CDT CVEs

    8.0.0.20 fixes three CVEs in msgpack handling and collection data types, plus cold-start set-membership loss and a recluster failure. It continues the memory-safety work from the July train on a single branch so far.

    View source ↗
  2. 3mo ago

    Aerospike 8.1.2.2 fixes UDF path traversal and batch heap overflow

    The 8.1 branch's carrier for the first CVE wave: UDF filename path traversal, a msgpack size-calculator integer overflow accepting truncated structures, and a heap buffer overflow in batch writes, each with its own security bulletin. Note the feed timestamps this a few seconds after 8.1.2.3, so the ordering here does not match version order.

    View source ↗
  3. 3mo ago

    Aerospike 8.1.2.3 fixes filter-expression validation bypass

    The second wave on the 8.1 branch: list and map values bypassing validation in filter expressions, a memory leak when a proxy target receives malformed or oversized requests, and an out-of-bounds read comparing msgpack integers. It also carries an Enterprise-only crash fix for MRT monitor transactions when security is enabled.

    View source ↗
  4. 3mo ago

    Aerospike 8.0.0.18 backports the msgpack and proxy-leak fixes

    The same AER-6925, AER-6926 and AER-6930 fixes as 8.1.2.3, delivered to the 8.0 branch nine minutes earlier. The accompanying bug fixes are branch-specific — a dump-wb-summary command rejection and a use_mounts leak on pmem initialization error paths.

    View source ↗
  5. 3mo ago

    Aerospike 8.0.0.17 backports the UDF and batch-write CVEs

    First-wave parity for the 8.0 branch, carrying the same three bulletin-backed fixes as 8.1.2.2. The pairing of a .17 and .18 release minutes apart shows the two waves were staged deliberately rather than merged.

    View source ↗
  6. 3mo ago

    Aerospike 7.2.0.20 backports second-wave fixes to the 7.2 branch

    The 7.2 branch receives the msgpack out-of-bounds read, proxy memory leak and filter-expression validation fixes, plus a memory restriction change. Evidence that a branch two major versions back is still on the same security schedule as current.

    View source ↗