GHSA-8r76-fr72-j32w: Mpl bubblegum Creator Verification Error When Bubblegum Vulnerability

HIGH
Share
Published
Advisory Summary

GHSA-8r76-fr72-j32w is a HIGH creator verification error when bubblegum vulnerability (General Security Weakness) affecting Mpl bubblegum libraries in the crates.io ecosystem. The issue involves creator verification error when bubblegum activate. Remediation is available by upgrading affected packages to version 0.6.0, 1.6.3.

GHSA-8r76-fr72-j32w at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-8r76-fr72-j32w
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Mpl bubblegum
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-8r76-fr72-j32w

To remediate this vulnerability, upgrade all affected Mpl bubblegum dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

mpl-bubblegum fixed: 0.6.0 
Upgrade mpl-bubblegum to 0.6.0
mpl-token-metadata fixed: 1.6.3 
Upgrade mpl-token-metadata to 1.6.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for mpl-bubblegum

How to Check if You Are Affected

To determine whether your application is affected by GHSA-8r76-fr72-j32w, inspect your project dependencies for Mpl bubblegum:

inspect dependencies for mpl-bubblegum

Analyze the terminal output to locate any version of Mpl bubblegum in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Mpl bubblegum, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360

GHSA-8r76-fr72-j32w Affected Mpl bubblegum Versions

2 component(s)
Fixed Versions:
0.6.01.6.3
Product / Package Ecosystem Affected Versions Fixed Version
mpl-bubblegum
 crates.io
< 0.6.0
0.6.0
mpl-token-metadata
 crates.io
≥ 1.5.0
< 1.6.3
1.6.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-8r76-fr72-j32w
Security Fix Commit FIX COMMIT
https://github.com/metaplex-foundation/metaplex-program-library/commit/c18591a7ce9bb561940cb94df4b7c35ef9cc0f57
Mpl bubblegum Source Repository REPOSITORY
https://github.com/metaplex-foundation/metaplex-program-library
twitter.com/thehasheddude/statu... WEB
https://twitter.com/thehasheddude/status/1601642138143375360

Frequently Asked Questions

What is GHSA-8r76-fr72-j32w?
GHSA-8r76-fr72-j32w is a security vulnerability in Mpl bubblegum involving Creator Verification Error when Bubblegum Activate under General Security Weakness.
Which Mpl bubblegum versions are affected?
Affected versions include releases prior to 0.6.0, 1.6.3 across affected packages: mpl-bubblegum, mpl-token-metadata.
What version fixes GHSA-8r76-fr72-j32w?
Upgrading to 0.6.0, 1.6.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is mpl-bubblegum affected?
Yes, mpl-bubblegum is affected in releases prior to 0.6.0. Upgrade your dependency to 0.6.0 or later.
Is mpl-token-metadata affected?
Yes, mpl-token-metadata is affected in releases prior to 1.6.3. Upgrade your dependency to 1.6.3 or later.
What CWE is associated with GHSA-8r76-fr72-j32w?
GHSA-8r76-fr72-j32w is classified under General Security Weakness.
How can I check crates.io dependencies for GHSA-8r76-fr72-j32w?
Run the dependency tree command: 'inspect dependencies for mpl-bubblegum'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8r76-fr72-j32w",
  "modified" : "2022-12-12T22:02:42Z",
  "published" : "2022-12-12T22:02:42Z",
  "aliases" : [ ],
  "summary" : "Creator Verification Error when Bubblegum Activate",
  "details" : "This was an error found by @metamania01 of the Audit Company Solshield.\n\nIt allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators.\n\nThe issue is now patched.\nFor more info see.\nhttps://twitter.com/thehasheddude/status/1601642138143375360",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "mpl-bubblegum"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.6.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "mpl-token-metadata"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.0"
      }, {
        "fixed" : "1.6.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-8r76-fr72-j32w"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/metaplex-foundation/metaplex-program-library/commit/c18591a7ce9bb561940cb94df4b7c35ef9cc0f57"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/metaplex-foundation/metaplex-program-library"
  }, {
    "type" : "WEB",
    "url" : "https://twitter.com/thehasheddude/status/1601642138143375360"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-12-12T22:02:42Z",
    "nvd_published_at" : null
  }
}