{"id":"GHSA-wwgf-3xp7-cxj4","aliases":[],"title":"Potentially sensitive data exposure in Symfony Web Socket Bundle","description":"### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)","severity":"medium","score":5.9,"published":"2020-07-07T16:33:45.000Z","modified":"2024-12-02T05:44:47.757Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"gos/web-socket-bundle","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.10.4"}],"type":"ECOSYSTEM"}],"versions":["V1.1.0","v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.2.0","v1.3.0","v1.3.1","v1.3.2","v1.4.0","v1.4.1","v1.4.2","v1.5.0","v1.5.1","v1.5.2","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.7.0","v1.7.1","v1.8.0","v1.8.1","v1.8.10","v1.8.11","v1.8.12","v1.8.12-rc1","v1.8.12-rc2","v1.8.12-rc3","v1.8.12-rc4","v1.8.12-rc5","v1.8.12-rc6","v1.8.13","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8","v1.8.9","v1.9.0","v1.9.0-rc1","v1.9.0-rc2","v1.9.0-rc3","v1.9.0-rc4"],"fixed":["1.10.4"]},{"ecosystem":"Packagist","name":"gos/web-socket-bundle","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}],"type":"ECOSYSTEM"}],"versions":["v2.0.0","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.5.0","v2.6.0"],"fixed":["2.6.1"]},{"ecosystem":"Packagist","name":"gos/web-socket-bundle","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.3.0"}],"type":"ECOSYSTEM"}],"versions":["v3.0.0","v3.1.0","v3.2.0"],"fixed":["3.3.0"]}],"sourceAffected":[],"references":["https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4","https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338","https://github.com/GeniusesOfSymfony/WebSocketBundle","https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401"],"sources":[{"name":"OSV","id":"GHSA-wwgf-3xp7-cxj4","modified":"2024-12-02T05:44:47.757624Z","url":"https://osv.dev/vulnerability/GHSA-wwgf-3xp7-cxj4"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9}]}