GHSA-wwgf-3xp7-cxj4
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wwgf-3xp7-cxj4
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-wwgf-3xp7-cxj4/GHSA-wwgf-3xp7-cxj4.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-wwgf-3xp7-cxj4
- Published
- 2020-07-07T16:33:45Z
- Modified
- 2024-12-02T05:46:10.369849Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Potentially sensitive data exposure in Symfony Web Socket Bundle
- Details
-
Impact
Inside
Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish(), messages are arbitrarily broadcasted to the related Topic ifGos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()does not succeed. Thedispatch()method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, aGos\Bundle\WebSocketBundle\Topic\TopicInterfaceimplementation is not found for the callback, a topic which also implementsGos\Bundle\WebSocketBundle\Topic\SecuredTopicInterfacerejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.Patches
In 1.10.4, 2.6.1, and 3.3.0,
Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()has been changed to no longer broadcast an event's data ifGos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()fails.Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
For more information
If you have any questions or comments about this advisory: * Open an issue in this repository
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-07-07T16:21:44Z" }- References
-
- https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4
- https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338
- https://github.com/GeniusesOfSymfony/WebSocketBundle
- https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401
Affected packages
Packagist / gos/web-socket-bundle
Package
- Name
- gos/web-socket-bundle
- Purl
- pkg:composer/gos/web-socket-bundle
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.10.4
Affected versions
V1.*
v1.*
Packagist / gos/web-socket-bundle
Package
- Name
- gos/web-socket-bundle
- Purl
- pkg:composer/gos/web-socket-bundle
Packagist / gos/web-socket-bundle
Package
- Name
- gos/web-socket-bundle
- Purl
- pkg:composer/gos/web-socket-bundle