Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

pocketmine/bedrock-protocol

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PackagistPublished

    Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown

    GHSA-5jfw-35xp-5m42

    Affected
    • Packagist pocketmine/bedrock-protocol < 8.0.2
    Fixed in
    8.0.2· Vendor fix available
    Issue
    Impact LoginPacket uses BinaryStream-getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream-getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream-get() to throw an exception. In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited. Patches e3fce7632b94e83fd6a518a87dcaf6a11681c4ac Workarounds This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it. For more information Email us at team@pmmp.io

    Recommended action: Upgrade to 8.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →