Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
31 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact When handling form responses from the client (ModalFormResponsePacket), the Minecraft Windows client may send weird JSON that jsondecode() can't understand. A workaround for this is implemented in InGamePacketHandler::stupidjsondecode(). An InvalidArgumentException is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash. Patches 56fe71d939c38fe14e18a31a673a9331bcc0e4ca Workarounds A plugin may handle DataPacketReceiveEvent, capture ModalFormResponsePacket and run the provided JSON through stupidjsondecode. Note that this requires copying the body of the function to a plugin, since the function is currently private. For more information If you have any questions or comments about this advisory: Email us at team@pmmp.io
Recommended action: Upgrade to 4.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values (e.g. negative), specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData (typically in InventoryTransactionPacket). Patches f126479c37ff00a717a828f5271cf8e821d12d6c Workarounds Using a plugin, cancel DataPacketReceiveEvent if the packet is PlayerActionPacket and the facing is outside the range 0-5 when receiving STARTBREAK or CRACKBLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases. For more information If you have any questions or comments about this advisory: Email us at team@pmmp.io
Recommended action: Upgrade to 4.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave. This is problematic due to the 32767 byte limit on TAGStrings. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash. Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB. Patches PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601 Workarounds A plugin may check player skins during PlayerLoginEvent and PlayerSkinChangeEvent and ensure that the offending fields are not larger than 32767 bytes. For more information If you have any questions or comments about this advisory: Email us at team@pmmp.io
Recommended action: Upgrade to 4.0.5 or 3.26.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Players can fill book pages with as many characters as they like; the server does not check this. In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs". This causes a variety of problems: - Oversized NBT on the wire costing excess bandwidth for server and client - Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific) - Server crashes if any book page exceeds 32 KiB (due to TAGString size limit) (PM4-specific) This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem. Patches The bug has been fixed in 3.26.5 and 4.0.5. Workarounds Ban writable books, or use a plugin to cancel PlayerEditBookEvent to cancel the event if strlen(text) 1024 || mbstrlen(text) 256. For more information If you have any questions or comments about this advisory: Email us at team@pmmp.io
Recommended action: Upgrade to 4.0.5 or 3.26.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Originally reported in iTXTech/Genisys#1188 deop PotterHarry98 will remove potterharry98 from the ops.txt but not PotterHarry98. Operator permissions are checked using Config-exists() with lowercase=true, which will result in a match: https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449 This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters. Patches 4d37b79ff7f9d9452e988387f97919a9a1c4954e Workarounds This can be easily addressed by removing the offending lines from ops.txt manually. For more information If you have any questions or comments about this advisory: Open an issue in pmmp/PocketMine-MP Email us at team@pmmp.io
Recommended action: Upgrade to 4.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Specially crafted InventoryTransactionPackets sent by malicious clients were able to exploit the behaviour of InventoryTransaction-findResultItem() and cause it to take an abnormally long time to execute (causing an apparent server freeze). The affected code is intended to compact conflicting InventoryActions which are in the same InventoryTransaction by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential. The problem was fixed by bailing when ambiguities are detected. At the time of writing, this exploit is being used in the wild by attackers to deny service to servers. Patches Upgrade to 3.15.4 or newer. Workarounds No practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to DataPacketReceiveEvent. References c368ebb5e74632bc622534b37cd1447b97281e20 For more information If you have any questions or comments about this advisory: Email us…
Recommended action: Upgrade to 3.15.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.