Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type. The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details. Patches https://github.com/solana-foundation/anchor/pull/4139 patched the issue and was released in 1.0.0-rc.2. Users should upgrade to the latest released version of Anchor 1.0. References Bug landed in: https://github.com/solana-foundation/anchor/pull/3837 Bug fixed in: https://github.com/solana-foundation/anchor/pull/4139
Recommended action: Upgrade to 1.0.0-rc.2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions. Details In the TryFrom<&'a AccountInfo<'a implementation for Program<'a, T, the id of T is compared with Pubkey::default() to check whether anchor should allow any executable account, or a specific account, because when no T is supplied, T defaults to (), which implements Id::id() by returning Pubkey::default(). This results in T = () and T = System (which has Pubkey::default() as the id) having the same behavior, both allow any executable account. Programs built with anchor assume that the anchor runtime verifies passed in programs of type Program<'a, System are in fact the system program. This false assumption can lead to arbitrary CPI or payment bypassing when programs try making CPI calls to the system program using the passed in system program due to the…
Recommended action: Upgrade to 1.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.