GHSA-wwgf-3xp7-cxj4: Gos/web socket bundle Potentially Sensitive Data Exposure Vulnerability
MODERATEGHSA-wwgf-3xp7-cxj4 is a MODERATE (CVSS 5.9) potentially sensitive data exposure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Gos/web socket bundle libraries in the Packagist ecosystem. The issue involves potentially sensitive data exposure in symfony web socket bundle. Remediation is available by upgrading affected packages to version 1.10.4, 2.6.1, 3.3.0.
GHSA-wwgf-3xp7-cxj4 at a Glance
Security Impact
CVSS: 5.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix GHSA-wwgf-3xp7-cxj4
To remediate this vulnerability, upgrade all affected Gos/web socket bundle dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade gos/web-socket-bundle to 1.10.4Upgrade gos/web-socket-bundle to 2.6.1Upgrade gos/web-socket-bundle to 3.3.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for gos/web-socket-bundleHow to Check if You Are Affected
To determine whether your application is affected by GHSA-wwgf-3xp7-cxj4, inspect your project dependencies for Gos/web socket bundle:
inspect dependencies for gos/web-socket-bundleAnalyze the terminal output to locate any version of Gos/web socket bundle in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.10.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Gos/web socket bundle, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-wwgf-3xp7-cxj4 Affected Gos/web socket bundle Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
gos/web-socket-bundle
|
Packagist |
< 1.10.4
|
1.10.4
|
|
gos/web-socket-bundle
|
Packagist |
≥ 2.0.0
< 2.6.1
|
2.6.1
|
|
gos/web-socket-bundle
|
Packagist |
≥ 3.0.0
< 3.3.0
|
3.3.0
|
References
Frequently Asked Questions
What is GHSA-wwgf-3xp7-cxj4?
Which Gos/web socket bundle versions are affected?
What version fixes GHSA-wwgf-3xp7-cxj4?
Is gos/web-socket-bundle affected?
What is the CVSS score of GHSA-wwgf-3xp7-cxj4?
What CWE is associated with GHSA-wwgf-3xp7-cxj4?
How can I check Packagist dependencies for GHSA-wwgf-3xp7-cxj4?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wwgf-3xp7-cxj4",
"modified" : "2021-09-22T20:22:02Z",
"published" : "2020-07-07T16:33:45Z",
"aliases" : [ ],
"summary" : "Potentially sensitive data exposure in Symfony Web Socket Bundle",
"details" : "### Impact\nInside `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` does not succeed. The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\\Bundle\\WebSocketBundle\\Topic\\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\\Bundle\\WebSocketBundle\\Topic\\SecuredTopicInterface` rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.\n\n### Patches\nIn 1.10.4, 2.6.1, and 3.3.0, `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\\Bundle\\WebSocketBundle\\Server\\App\\Dispatcher\\TopicDispatcher::dispatch()` fails.\n\n### Workarounds\nUpgrade to 1.10.4, 2.6.1, and 3.3.0\n\nNote, the 1.x branch is considered end of support as of July 1, 2020.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "gos/web-socket-bundle"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.10.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "gos/web-socket-bundle"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.6.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "gos/web-socket-bundle"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.3.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/GeniusesOfSymfony/WebSocketBundle"
}, {
"type" : "WEB",
"url" : "https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2020-07-07T16:21:44Z",
"nvd_published_at" : null
}
}