{"id":"GHSA-8r76-fr72-j32w","summary":"Creator Verification Error when Bubblegum Activate","details":"This was an error found by @metamania01 of the Audit Company Solshield.\n\nIt allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators.\n\nThe issue is now patched.\nFor more info see.\nhttps://twitter.com/thehasheddude/status/1601642138143375360","modified":"2022-12-12T22:02:42Z","published":"2022-12-12T22:02:42Z","database_specific":{"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-12-12T22:02:42Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-8r76-fr72-j32w"},{"type":"WEB","url":"https://github.com/metaplex-foundation/metaplex-program-library/commit/c18591a7ce9bb561940cb94df4b7c35ef9cc0f57"},{"type":"PACKAGE","url":"https://github.com/metaplex-foundation/metaplex-program-library"},{"type":"WEB","url":"https://twitter.com/thehasheddude/status/1601642138143375360"}],"affected":[{"package":{"name":"mpl-bubblegum","ecosystem":"crates.io","purl":"pkg:cargo/mpl-bubblegum"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-8r76-fr72-j32w/GHSA-8r76-fr72-j32w.json"}},{"package":{"name":"mpl-token-metadata","ecosystem":"crates.io","purl":"pkg:cargo/mpl-token-metadata"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-8r76-fr72-j32w/GHSA-8r76-fr72-j32w.json"}}],"schema_version":"1.9.0"}