{"id":"GHSA-8jq6-w5cg-wm45","aliases":[],"url":"https://o3.security/vulnerability/GHSA-8jq6-w5cg-wm45","summary":"Exploitable inventory component chaining in PocketMine-MP","details":"### Impact\nSpecially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze).\n\nThe affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential.\n\nThe problem was fixed by bailing when ambiguities are detected.\n\n**At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.**\n\n### Patches\nUpgrade to 3.15.4 or newer.\n\n### Workarounds\nNo practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`.\n\n### References\nc368ebb5e74632bc622534b37cd1447b97281e20\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","published":"2020-11-11T21:38:18Z","modified":"2024-12-02T05:47:11.219050Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"3.15.4"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-02T05:47:11.219050Z"}}