PT-2022-28223 · Crates.Io · Mpl-Bubblegum+1

Published 2022-12-12 · Updated 2022-12-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned.

Description The issue allowed verification of a creator that did not sign by utilizing a provision in Token Metadata. This provision enables creators who have signed compressed NFTs to decompress them with verified creators. The issue has been patched.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-8R76-FR72-J32W

Affected Products

Mpl-Bubblegum

Mpl-Token-Metadata

References · 5

• https://osv.dev/vulnerability/GHSA-8r76-fr72-j32w · Vendor Advisory
• https://github.com/metaplex-foundation/metaplex-program-library/commit/c18591a7ce9bb561940cb94df4b7c35ef9cc0f57 · Note
• https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-8r76-fr72-j32w · Note
• https://github.com/metaplex-foundation/metaplex-program-library · Note
• https://twitter.com/thehasheddude/status/1601642138143375360 · Note