TI-2022-26701 Aliases GHSA-8r76-fr72-j32w

Creator Verification Error when Bubblegum Activate

LOW 38Published 2022-12-12 · Updated 2022-12-12

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360

Why it matters now

Fix Fixed mpl-bubblegum (crates.io): 0.6.0mpl-token-metadata (crates.io): 1.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	mpl-bubblegum (crates.io)	before 0.6.0	0.6.0	Patch available	GHSA-8r76-fr72-j32w
—	mpl-token-metadata (crates.io)	1.5.0 to before 1.6.3	1.6.3	Patch available	GHSA-8r76-fr72-j32w

mpl-bubblegum (crates.io) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-8r76-fr72-j32w
mpl-token-metadata (crates.io) Vendor— Affected 1.5.0 to before 1.6.3 Fixed in 1.6.3 Patch available GHSA-8r76-fr72-j32w

Remediation

Fix · GHSA-8r76-fr72-j32w mpl-bubblegum (crates.io) Fixed in 0.6.0 Advisory →
Fix · GHSA-8r76-fr72-j32w mpl-token-metadata (crates.io) Fixed in 1.6.3 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-8r76-fr72-j32w

References

Other 4

Sources

GHSA-8r76-fr72-j32w · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences