CVE-2023-54355

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.3.1 PocketMine-MP versions prior to 4.23.1

Description Failure to validate that the identityPublicKey in the LoginPacket uses the required secp384r1 elliptic curve allows attackers to bypass login verification. By providing keys using different curves or non-EC key types, an attacker can trigger an uncaught exception during ECDH (Elliptic Curve Diffie-Hellman) key derivation, which is a method used to calculate a shared secret for symmetric encryption. This results in a server crash.

Recommendations Update to version 5.3.1 or later. Update to version 4.23.1 or later. As a temporary workaround, use a plugin to handle LoginPacket and verify that all identityPublicKey values belong to the secp384r1 curve.