{"id":"GHSA-wwgf-3xp7-cxj4","aliases":[],"status":"published","title":"Potentially sensitive data exposure in Symfony Web Socket Bundle","description":"### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2020-07-07T16:33:45Z","modified":"2024-12-02T05:44:47Z","fixes":[{"ecosystem":"Packagist","package":"gos/web-socket-bundle","fixed_in":["1.10.4","2.6.1","3.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4"}]}],"versions":["V1.1.0","v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.2.0","v1.3.0","v1.3.1","v1.3.2","v1.4.0","v1.4.1","v1.4.2","v1.5.0","v1.5.1","v1.5.2","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.7.0","v1.7.1","v1.8.0","v1.8.1","v1.8.10","v1.8.11","v1.8.12","v1.8.12-rc1","v1.8.12-rc2","v1.8.12-rc3","v1.8.12-rc4","v1.8.12-rc5","v1.8.12-rc6","v1.8.13","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8","v1.8.9","v1.9.0","v1.9.0-rc1","v1.9.0-rc2","v1.9.0-rc3","v1.9.0-rc4"]},{"source":"osv","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}]}],"versions":["v2.0.0","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.5.0","v2.6.0"]},{"source":"osv","ecosystem":"Packagist","package":"gos/web-socket-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0"}]}],"versions":["v3.0.0","v3.1.0","v3.2.0"]}],"references":[{"url":"https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wwgf-3xp7-cxj4"},{"url":"https://github.com/GeniusesOfSymfony/WebSocketBundle","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-wwgf-3xp7-cxj4","title":"Potentially sensitive data exposure in Symfony Web Socket Bundle","description":"### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)","status":"published","published":"2020-07-07T16:33:45Z","modified":"2023-01-09T05:03:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"osv":[{"id":"GHSA-wwgf-3xp7-cxj4","title":"Potentially sensitive data exposure in Symfony Web Socket Bundle","description":"### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)","status":"published","published":"2020-07-07T16:33:45Z","modified":"2024-12-02T05:44:47.757624Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}