Packagist/pocketmine/pocketmine-mp CVE-2024-58381: high 7.5, EPSS 0.43%
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)
Action: Upgrade pocketmine/pocketmine-mp to 5.11.1 or later.
composer require pocketmine/pocketmine-mp:5.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.11.1 | - |
Fixed versions
| 5.11.1 |
Sources
- osv: GHSA-h6j3-j35f-v2x7
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7
- https://github.com/cweiske/jsonmapper/issues/226
- https://github.com/cweiske/jsonmapper/pull/225
- https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9
- https://github.com/pmmp/netresearch-jsonmapper/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7
- https://github.com/pmmp/PocketMine-MP
CVE-2024-58381 · published · modified · JSON