{"id":"GHSA-wwgf-3xp7-cxj4","summary":"Potentially sensitive data exposure in Symfony Web Socket Bundle","details":"### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)","modified":"2024-12-02T05:44:47.757624Z","published":"2020-07-07T16:33:45Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-07-07T16:21:44Z","nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338"},{"type":"PACKAGE","url":"https://github.com/GeniusesOfSymfony/WebSocketBundle"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401"}],"affected":[{"package":{"name":"gos/web-socket-bundle","ecosystem":"Packagist","purl":"pkg:composer/gos/web-socket-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4"}]}],"versions":["V1.1.0","v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.2.0","v1.3.0","v1.3.1","v1.3.2","v1.4.0","v1.4.1","v1.4.2","v1.5.0","v1.5.1","v1.5.2","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.7.0","v1.7.1","v1.8.0","v1.8.1","v1.8.10","v1.8.11","v1.8.12","v1.8.12-rc1","v1.8.12-rc2","v1.8.12-rc3","v1.8.12-rc4","v1.8.12-rc5","v1.8.12-rc6","v1.8.13","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8","v1.8.9","v1.9.0","v1.9.0-rc1","v1.9.0-rc2","v1.9.0-rc3","v1.9.0-rc4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-wwgf-3xp7-cxj4/GHSA-wwgf-3xp7-cxj4.json"}},{"package":{"name":"gos/web-socket-bundle","ecosystem":"Packagist","purl":"pkg:composer/gos/web-socket-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}]}],"versions":["v2.0.0","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.5.0","v2.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-wwgf-3xp7-cxj4/GHSA-wwgf-3xp7-cxj4.json"}},{"package":{"name":"gos/web-socket-bundle","ecosystem":"Packagist","purl":"pkg:composer/gos/web-socket-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0"}]}],"versions":["v3.0.0","v3.1.0","v3.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-wwgf-3xp7-cxj4/GHSA-wwgf-3xp7-cxj4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}