GHSA-pg53-p7qp-65cv
Dashboard / Vulnerabilities / GHSA-pg53-p7qp-65cv
Summary: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Details: ### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. ### Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as `AvailableCommandsPacket` and `CreativeContentPacket`. ### Workarounds Plugins can use their own `PacketHandler` classes that reject/ignore any extra `ResourcePackClientResponsePacket` packets. ### Patches This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
References: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv, https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3, https://github.com/pmmp/PocketMine-MP, https://github.com/pmmp/PocketMine-MP/releases/tag/5.44.2
Affected packages
Package
Name: pocketmine/pocketmine-mp
Purl: pkg:composer/pocketmine/pocketmine-mp
Affected ranges
Type: ECOSYSTEM
Events:
