Description
PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | 4.20.0 – < 4.22.3, 5.0.0 – < 5.2.1 | 4.22.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | >= 4.20.0, < 4.22.3 | 4.22.3 | GHSA-7wrv-6h42-w54f |
| Packagist | pocketmine/pocketmine-mp | >= 5.0.0, < 5.2.1 | 5.2.1 | GHSA-7wrv-6h42-w54f |
References
- GitHub Security Advisory (GHSA-7wrv-6h42-w54f) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket third-party-advisory