Log in Start free

Vulnerability · Published Dec 6, 2023 · Assigned by snyk

CVE-2023-26154

Medium 5.9

In plain English

A medium-severity security flaw in com.pubnub:pubnub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.0%top 38.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/pubnub/go0.0.0-20231016150651-428517fef5b9GHSA-5844-q3fc-56rh
Gogithub.com/pubnub/gono fix listedGO-2023-2385
Gogithub.com/pubnub/go/v5no fix listedGO-2023-2385
Gogithub.com/pubnub/go/v55.0.4-0.20231016150651-428517fef5b9GHSA-5844-q3fc-56rh
Gogithub.com/pubnub/go/v6no fix listedGO-2023-2385
Gogithub.com/pubnub/go/v66.1.1-0.20231016150651-428517fef5b9GHSA-5844-q3fc-56rh
Gogithub.com/pubnub/go/v77.2.0GHSA-5844-q3fc-56rh
Gogithub.com/pubnub/go/v77.2.0GO-2023-2385
Mavencom.pubnub:pubnubno fix listedGHSA-5844-q3fc-56rh
Mavencom.pubnub:pubnub-kotlin7.7.0GHSA-5844-q3fc-56rh
NuGetpubnub6.19.0GHSA-5844-q3fc-56rh
Packagistpubnub/pubnub6.1.0GHSA-5844-q3fc-56rh
PyPIpubnub7.3.0GHSA-5844-q3fc-56rh
PyPIpubnub7.3.0PYSEC-2026-1807
RubyGemspubnub5.3.0GHSA-5844-q3fc-56rh
npmpubnub7.4.0GHSA-5844-q3fc-56rh

Affected products (as reported)

VendorProductVersions
n/a pubnub 0 – before 7.4.0
n/a com.pubnub:pubnub 0 – before *
n/a Pubnub 0 – before 6.19.0
n/a github.com/pubnub/go 0 – before *
n/a github.com/pubnub/go/v7 0 – before 7.2.0
n/a pubnub 0 – before 7.3.0
n/a pubnub/pubnub 0 – before 6.1.0
n/a pubnub 0 – before 5.3.0
n/a pubnub 0 – before 0.4.0
n/a pubnub/c-core 0 – before 4.5.0
n/a com.pubnub:pubnub-kotlin 0 – before 7.7.0
n/a pubnub/swift 0 – before 6.2.0
n/a PubNub 0 – before 5.2.0
n/a pubnub 0 – before 4.3.0

Weakness: CWE-331 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References