SB2021051968 - Improper input validation in PocketMine-MP

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in MovePlayerPacket handling when processing serverbound movement packets containing NaN or INF values in position or rotation fields. A remote attacker can send a specially crafted MovePlayerPacket to cause a denial of service.

Malformed rotation values may also prevent clients from seeing other clients correctly, and clients may crash when such values are processed.

Remediation

Install update from vendor's website.

References

• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx
• https://github.com/advisories/GHSA-fm35-jgg3-3grx