Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2023-54355

PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 4.23.1affected
  • 5.2.0 to < 5.3.1affected
pkg:composer/pocketmine/pocketmine-mp

References