Security Advisories - pocketmine/pocketmine-mp

pocketmine/pocketmine-mp Security Advisories for 3.5.6 (25)

[LOW] PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state

PKSA-t7y4-spmt-39ct GHSA-f9jp-856v-8642

Affected version: <5.39.2

Reported by:
GitHub
[MEDIUM] PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

PKSA-yw3m-b28c-y6hc GHSA-7hmv-4j2j-pp6f

Affected version: <5.39.2

Reported by:
GitHub
[HIGH] PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

PKSA-cnjv-js4w-1xcs GHSA-788v-5pfp-93ff

Affected version: <5.39.2

Reported by:
GitHub
[HIGH] PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

PKSA-h4z5-fb6q-736p GHSA-h6rj-3m53-887h

Affected version: <5.41.1

Reported by:
GitHub
[HIGH] PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking

PKSA-gsjv-vrbx-n6br GHSA-fqqv-56h5-f57g

Affected version: <5.32.1

Reported by:
GitHub
[MEDIUM] PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

PKSA-1y47-vhgh-zq2y GHSA-g274-c6jj-h78p

Affected version: <5.25.2

Reported by:
GitHub
[HIGH] PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

PKSA-7cft-g1hs-ddc8 GHSA-h6j3-j35f-v2x7

Affected version: <5.11.1

Reported by:
GitHub
[HIGH] PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

PKSA-krv9-c6mg-smc2 GHSA-xc7j-wj36-qjfr

Affected version: <5.11.2

Reported by:
GitHub
[HIGH] PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

PKSA-nv2r-zxzd-wzsw GHSA-92jh-gwch-jq38

Affected version: <=4.23.0|>=5.0.0,<=5.3.0

Reported by:
GitHub
[HIGH] PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash

PKSA-rjb4-mbc7-gvrq CVE-2023-7332 GHSA-h87r-f4vc-mchv

Affected version: <4.18.1

Reported by:
GitHub
[HIGH] PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

PKSA-mdrw-7xfy-3575 GHSA-pqp3-8rrw-g8vm

Affected version: >=4.21.0,<4.21.1|<4.20.5

Reported by:
GitHub
[MEDIUM] PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'

PKSA-3mjs-tbmc-n317 GHSA-42qm-8v8m-m78c

Affected version: <4.18.0-ALPHA2

Reported by:
GitHub
[MEDIUM] PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

PKSA-6mdv-sgnk-4jgv GHSA-7m9r-rq9j-wmmh

Affected version: <4.12.5

Reported by:
GitHub
[HIGH] PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash

PKSA-dy8b-jxh6-kdd2 GHSA-wqqv-jcfr-9f5g

Affected version: <4.8.1

Reported by:
GitHub
[HIGH] PocketMine-MP invalid skin geometry JSON data leading to server crash

PKSA-g2v4-vgph-zkgr GHSA-8cwq-4cmf-px73

Affected version: <4.7.2

Reported by:
GitHub
[MEDIUM] Denial-of-service vulnerability processing large chat messages containing many newlines

PKSA-kq9f-6mzv-9z4b GHSA-gj94-v4p9-w672

Affected version: <4.2.10

Reported by:
GitHub
[HIGH] Insufficient type validation in pocketmine/pocketmine-mp

PKSA-8sgq-z2gv-62hz GHSA-g5rr-p69h-7v3g

Affected version: <4.2.9

Reported by:
GitHub
[HIGH] Improperly checked metadata on tools/armour itemstacks received from the client

PKSA-7kfz-3qgv-gptj GHSA-46c5-pfj8-fv65

Affected version: <4.2.4

Reported by:
GitHub
[HIGH] NaN/INF in serverbound movement packets can crash clients and servers

PKSA-cnz3-d6jt-3shh GHSA-fm35-jgg3-3grx

Affected version: <=3.18.0

Reported by:
GitHub
[MEDIUM] Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP

PKSA-6y7g-ysy5-mk9f GHSA-h79x-98r2-g6qc

Affected version: >=3.0.0,<4.0.0

Reported by:
GitHub
[HIGH] Unchecked validity of Facing values in PlayerActionPacket

PKSA-x9kw-xss7-ydqj GHSA-xh99-hw7h-wf63

Affected version: <4.0.6

Reported by:
GitHub
[HIGH] Uncapped length of skin data fields submitted by players

PKSA-kbjw-qcz9-hw4r GHSA-c6fg-99pr-25m9

Affected version: >=4.0.0,<4.0.5|<3.26.5

Reported by:
GitHub
[MEDIUM] Book page text, count, and author/title length is not limited in PocketMine-MP

PKSA-cqgn-qh62-vy4g GHSA-p62j-hrxm-xcxf

Affected version: >=4.0.0,<4.0.5|<3.26.5

Reported by:
GitHub
[LOW] Inability to de-op players if listed in ops.txt with non-lowercase letters

PKSA-j497-g66n-z3zj GHSA-j5qg-w9jg-3wg3

Affected version: <4.0.3

Reported by:
GitHub
[HIGH] Exploitable inventory component chaining in PocketMine-MP

PKSA-69r1-zx55-fghf GHSA-8jq6-w5cg-wm45

Affected version: <3.15.4

Reported by:
GitHub

pocketmine/pocketmine-mp Security Advisories for 3.5.6 (25)

[LOW] PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state

[MEDIUM] PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

[HIGH] PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

[HIGH] PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

[HIGH] PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking

[MEDIUM] PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

[HIGH] PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

[HIGH] PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

[HIGH] PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

[HIGH] PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash

[HIGH] PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

[MEDIUM] PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'

[MEDIUM] PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

[HIGH] PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash

[HIGH] PocketMine-MP invalid skin geometry JSON data leading to server crash

[MEDIUM] Denial-of-service vulnerability processing large chat messages containing many newlines

[HIGH] Insufficient type validation in pocketmine/pocketmine-mp

[HIGH] Improperly checked metadata on tools/armour itemstacks received from the client

[HIGH] NaN/INF in serverbound movement packets can crash clients and servers

[MEDIUM] Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP

[HIGH] Unchecked validity of Facing values in PlayerActionPacket

[HIGH] Uncapped length of skin data fields submitted by players

[MEDIUM] Book page text, count, and author/title length is not limited in PocketMine-MP

[LOW] Inability to de-op players if listed in ops.txt with non-lowercase letters

[HIGH] Exploitable inventory component chaining in PocketMine-MP