Packagist/pocketmine/pocketmine-mp CVE-2023-54393: high 7.5
PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency
Action: Upgrade pocketmine/pocketmine-mp to 4.20.5 or later.
composer require pocketmine/pocketmine-mp:4.20.5composer require pocketmine/pocketmine-mp:4.21.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.20.5 | - |
| 4.21.0 | 4.21.1 | - |
Fixed versions
| 4.20.5 | 4.21.1 |
Sources
- osv: GHSA-pqp3-8rrw-g8vm
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pqp3-8rrw-g8vm
- https://github.com/cweiske/jsonmapper/pull/210
- https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2
- https://github.com/pmmp/netresearch-jsonmapper/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012
- https://github.com/pmmp/PocketMine-MP
CVE-2023-54393 · published · modified · JSON