CVE-2023-54390
1 advisory.
Packagist/pocketmine/pocketmine-mp CVE-2023-54390: high 7.5, EPSS 0.34%
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)
Action: Upgrade pocketmine/pocketmine-mp to 4.23.1 or later.
composer require pocketmine/pocketmine-mp:5.3.1composer require pocketmine/pocketmine-mp:4.23.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.3.1 | - |
| 0 | 4.23.1 | - |
Fixed versions
| 5.3.1 | 4.23.1 |
Sources
- osv: GHSA-92jh-gwch-jq38
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
- https://github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
- https://github.com/pmmp/PocketMine-MP
CVE-2023-54390 · published · modified · JSON