p PatchFirst

CVE-2023-54392

CVE-2023-54392 · PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • pocketmine-mp

    Versions
    • ≥ 4.20.0, < 4.22.3: Affected (semver)
    • ≥ 5.0.0, < 5.2.1: Affected (semver)

    Update to 4.22.3; Update to 5.2.1

  • pocketmine/pocketmine-mp Packagist

    Versions
    • 4.20.0
    • 4.20.1
    • 4.20.2
    • 4.20.3
    • 4.20.4
    • 4.20.5
    • 4.21.0
    • 4.21.1
    • 4.22.0
    • 4.22.1
    • 4.22.2
    Affected ranges
    • ECOSYSTEM: ≥ 4.20.0, < 4.22.3

    Update to 4.22.3

  • pocketmine/pocketmine-mp Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.1.3
    • 5.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.2.1

    Update to 5.2.1

Original sources

Check your server →