v1.20.6 - Gameserver vulnerability fix

[Tyron]

Dear Extraordinary Survivalists 
v1.20.6, a stable release, can now be downloaded through the account manager.

We suggest to urgently update all game servers to this latest version, as all game versions of the last 6 years are affected. An issue was discovered which could allow a player to create arbitrary blocks and items, including Command Blocks which can run arbitrary server commands under admin privileges. This release should both fix the creation of arbitrary items as well as the ability to use Command Blocks as a Survival Mode player. Only the servers need to update. The game clients can remain on 1.20.5.
To clarify: This vulnerability only affected server commands via Command Blocks, not via the underlying server console / shell.

Game updates

• Tweak: Don't print audit logs to console, but to debug window only
• Fixed: Gameserver privilege escalation vulnerability on multiplayer servers
• Fixed: Large underground ruin having one of the creative blocks in it
• Fixed: Updated Harmony to 2.3.5 which should fix issue when using Harmony mods on Linux systems using GLIBC 2.41 and newer

View full record

[Brandy88975]

Thank you my master!

Edited March 20, 2025 by AccountForSister

[DUCATISLO]

thx tyrone

[Aarón Ordónez]

wow thanks for your work 

[Connor Roland]

I actually found a block randomizer in an underground ruin once but i cant remember if it was a modded ruin or not

[cammera]

Yo thanks for the linux fix

[Rhyagelle]

Hell yeah, love seeing this game get updated with such frequency and urgency, especially when issues like this drops. Also, thank you for the Linux fix!