GHSA-92jh-gwch-jq38: Pocketmine/pocketmine mp PocketMine-MP Server Crash With Certain Vulnerability
HIGHGHSA-92jh-gwch-jq38 is a HIGH (CVSS 7.5) pocketmine-mp server crash with certain vulnerability (General Security Weakness) affecting Pocketmine/pocketmine mp libraries in the Packagist ecosystem. The issue involves pocketmine-mp server crash with certain invalid json payloads in `loginpacket` due to dependency vulnerability (again). Remediation is available by upgrading affected packages to version 5.3.1, 4.23.1.
GHSA-92jh-gwch-jq38 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix GHSA-92jh-gwch-jq38
To remediate this vulnerability, upgrade all affected Pocketmine/pocketmine mp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade pocketmine/pocketmine-mp to 5.3.1Upgrade pocketmine/pocketmine-mp to 4.23.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for pocketmine/pocketmine-mpHow to Check if You Are Affected
To determine whether your application is affected by GHSA-92jh-gwch-jq38, inspect your project dependencies for Pocketmine/pocketmine mp:
inspect dependencies for pocketmine/pocketmine-mpAnalyze the terminal output to locate any version of Pocketmine/pocketmine mp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.3.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Pocketmine/pocketmine mp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-92jh-gwch-jq38 Affected Pocketmine/pocketmine mp Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pocketmine/pocketmine-mp
|
Packagist |
≥ 5.0.0
< 5.3.1
|
5.3.1
|
|
pocketmine/pocketmine-mp
|
Packagist |
< 4.23.1
|
4.23.1
|
References
Frequently Asked Questions
What is GHSA-92jh-gwch-jq38?
Which Pocketmine/pocketmine mp versions are affected?
What version fixes GHSA-92jh-gwch-jq38?
Is pocketmine/pocketmine-mp affected?
What is the CVSS score of GHSA-92jh-gwch-jq38?
What CWE is associated with GHSA-92jh-gwch-jq38?
How can I check Packagist dependencies for GHSA-92jh-gwch-jq38?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-92jh-gwch-jq38",
"modified" : "2024-05-23T20:46:33Z",
"published" : "2023-09-14T17:10:37Z",
"aliases" : [ ],
"summary" : "PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)",
"details" : "### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in `LoginPacket`.\n\nThis happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect.\n\n Code processing arrays in the JSON data could then crash due to unexpected `NULL` elements.\n\n### Patches\nThis problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c\n\nAn upstream patch for this issue was proposed via https://github.com/cweiske/jsonmapper/pull/211; however, as of 2024-05-15, the patch has not been accepted upstream due to debate about how to deal with the behavior. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent` for `LoginPacket` and check that none of the input arrays contain `NULL` where it's not expected, but this is rather cumbersome.\n\n### References\nProposed upstream patch for a behavior change: https://github.com/cweiske/jsonmapper/pull/211",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "pocketmine/pocketmine-mp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0"
}, {
"fixed" : "5.3.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.3.0"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "pocketmine/pocketmine-mp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.23.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.23.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38"
}, {
"type" : "WEB",
"url" : "https://github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e882668c"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pmmp/PocketMine-MP"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-09-14T17:10:37Z",
"nvd_published_at" : null
}
}