Description
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 4.20.5, 4.21.0 – < 4.21.1 | 4.20.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 4.20.5 | 4.20.5 | GHSA-pqp3-8rrw-g8vm |
| Packagist | pocketmine/pocketmine-mp | >= 4.21.0, < 4.21.1 | 4.21.1 | GHSA-pqp3-8rrw-g8vm |
References
- GitHub Security Advisory (GHSA-pqp3-8rrw-g8vm) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.20.5 Denial of Service via LoginPacket third-party-advisory