GHSA-h6j3-j35f-v2x7: Pocketmine/pocketmine mp PocketMine-MP Server Crash With Certain Vulnerability
HIGHGHSA-h6j3-j35f-v2x7 is a HIGH (CVSS 7.5) pocketmine-mp server crash with certain vulnerability (General Security Weakness) affecting Pocketmine/pocketmine mp libraries in the Packagist ecosystem. The issue involves pocketmine-mp server crash with certain invalid json payloads in `loginpacket` due to dependency vulnerability (3rd time). Remediation is available by upgrading affected packages to version 5.11.1.
GHSA-h6j3-j35f-v2x7 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix GHSA-h6j3-j35f-v2x7
To remediate this vulnerability, upgrade all affected Pocketmine/pocketmine mp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade pocketmine/pocketmine-mp to 5.11.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for pocketmine/pocketmine-mpHow to Check if You Are Affected
To determine whether your application is affected by GHSA-h6j3-j35f-v2x7, inspect your project dependencies for Pocketmine/pocketmine mp:
inspect dependencies for pocketmine/pocketmine-mpAnalyze the terminal output to locate any version of Pocketmine/pocketmine mp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.11.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Pocketmine/pocketmine mp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-h6j3-j35f-v2x7 Affected Pocketmine/pocketmine mp Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pocketmine/pocketmine-mp
|
Packagist |
< 5.11.1
|
5.11.1
|
References
Frequently Asked Questions
What is GHSA-h6j3-j35f-v2x7?
Which Pocketmine/pocketmine mp versions are affected?
What version fixes GHSA-h6j3-j35f-v2x7?
Is pocketmine/pocketmine-mp affected?
What is the CVSS score of GHSA-h6j3-j35f-v2x7?
What CWE is associated with GHSA-h6j3-j35f-v2x7?
How can I check Packagist dependencies for GHSA-h6j3-j35f-v2x7?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-h6j3-j35f-v2x7",
"modified" : "2024-05-15T14:30:10Z",
"published" : "2024-03-06T17:02:06Z",
"aliases" : [ ],
"summary" : "PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)",
"details" : "### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.\n\n[netresearch/jsonmapper](https://github.com/cweiske/JsonMapper) allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to objects whose constructors don't handle the input values.\n\nCode handling these objects in PocketMine-MP could then crash due to `@required` properties not being set within the objects.\n\nIn addition, because JsonMapper does not respect `bStrictObjectTypes` when processing arrays, it's not possible to avoid the issue by disabling the feature.\n\nDue to the relatively high number of security issues arising from unexpected behaviour in JsonMapper, the team is exploring options to replace it.\n\n### Patches\nIn the meantime, the issue was fixed by pmmp/netresearch-jsonmapper@b96a209f9e8b76b899a0d0918493cd87eb3c02a7 and 6872661fd03649cc7a8762c41c16e9ee5a4de1c9.\n\n### Workarounds\nDetecting the malicious data that triggers this issue is of rather high difficulty, so it's not likely that a plugin would be able to easily remediate this.\n\n### References\nhttps://github.com/cweiske/jsonmapper/pull/225\nhttps://github.com/cweiske/jsonmapper/issues/226\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "pocketmine/pocketmine-mp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "5.11.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7"
}, {
"type" : "WEB",
"url" : "https://github.com/cweiske/jsonmapper/issues/226"
}, {
"type" : "WEB",
"url" : "https://github.com/cweiske/jsonmapper/pull/225"
}, {
"type" : "WEB",
"url" : "https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9"
}, {
"type" : "WEB",
"url" : "https://github.com/pmmp/netresearch-jsonmapper/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pmmp/PocketMine-MP"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-03-06T17:02:06Z",
"nvd_published_at" : null
}
}