CVE-2022-24300

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

References

Affected packages

Git / github.com/luanti-org/luanti

Affected ranges

Type: GIT
Repo: https://github.com/luanti-org/luanti
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b5956bde259faa240a81060ff4e598e25ad52dae

Affected versions

0.*

0.2.20110731_3

0.2.20110922

0.2.20110922_1

0.3.0

0.3.1

0.3.dev-20111021

0.4.0

0.4.1

0.4.10

0.4.11

0.4.13

0.4.14

0.4.15

0.4.16

0.4.2-rc1

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.7-MSVC

0.4.8

0.4.9

0.4.dev-20111201-0

0.4.dev-20111202-1

0.4.dev-20111203-1

0.4.dev-20111203-2

0.4.dev-20111203-3

0.4.dev-20111204-1

0.4.dev-20111209-1

0.4.dev-20120106-1

0.4.dev-20120122-1

0.4.dev-20120318

0.4.dev-20120320

0.4.dev-20120326

0.4.dev-20120408

0.4.dev-20120603

0.4.dev-20120606

5.*

5.0.0

5.1.0

5.2.0

5.3.0

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
        "target": {
            "function": "ItemStackMetadata::setString",
            "file": "src/itemstackmetadata.cpp"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2022-24300-1938ff24",
        "digest": {
            "length": 196.0,
            "function_hash": "53408133224196420866388612428380162363"
        }
    },
    {
        "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
        "target": {
            "file": "src/itemstackmetadata.cpp"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2022-24300-2edc632b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "139091593272906886536187692800344746310",
                "147833175575904894199468214698151422506",
                "285130253436111299565579533393835422191",
                "136955139694349349319049353098607610634",
                "232826309761223626484778440077722443760",
                "229672279112784701421788494966258695778",
                "119741633168882156739549111384133518796",
                "59095601892421019714297209725059810961",
                "315452706849647259784930325093990111991",
                "220448486910237519561833148909854796795"
            ]
        }
    }
]

Git / github.com/minetest/minetest