GHSA-pg53-p7qp-65cv
Mở trang đầy đủCVSS 2.3 LOW
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Mô tả
Summary
During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.
Impact
Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.
Workarounds
Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.
Patches
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
Điểm và phân loại
- CVSS
- 2.3 LOW v4.0
- Nguồn điểm
- GitHub Advisory
- Mức độ (theo nguồn)
- LOW
- EPSS
- —
- CWE
- CWE-837
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Ảnh hưởng
| Package | Bản bị ảnh hưởng | Bản đã sửa |
|---|---|---|
composer pocketmine/pocketmine-mp |
< 5.44.2 |
5.44.2
|
Vì sao bị lọc
- CVSS 2.3 < 8.0 và không thuộc CISA KEV
Loại tác động
Không nhận ra loại tác động nào từ CWE, vector hay mô tả.