CVE-2023-26154

🗓️ 06 Dec 2023 05:00:02Reported by snykType

Versions of the package pubnub before 7.4.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption

Reporter	Title	Published	Views	Family All 37
CNNVD	PubNub Security Breach	6 Dec 202300:00	–	cnnvd
CVE	CVE-2023-26154	6 Dec 202305:00	–	cve
EUVD	EUVD-2023-3110	3 Oct 202520:07	–	euvd
Github Security Blog	pubnub Insufficient Entropy vulnerability	6 Dec 202306:30	–	github
GitLab Advisory Database	pubnub Insufficient Entropy vulnerability	6 Dec 202300:00	–	gitlab
GitLab Advisory Database	pubnub Insufficient Entropy vulnerability	6 Dec 202300:00	–	gitlab
NVD	CVE-2023-26154	6 Dec 202305:15	–	nvd
OPENSUSE Linux	govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media (moderate)	21 Aug 202500:00	–	opensuse
OSV	CVE-2023-26154	6 Dec 202305:00	–	osv
OSV	GHSA-5844-Q3FC-56RH pubnub Insufficient Entropy vulnerability	6 Dec 202306:30	–	osv

[
  {
    "product": "pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "7.4.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "com.pubnub:pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "Pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "6.19.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/pubnub/go",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/pubnub/go/v7",
    "versions": [
      {
        "version": "0",
        "lessThan": "7.2.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "7.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub/pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "6.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "5.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.4.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub/c-core",
    "versions": [
      {
        "version": "0",
        "lessThan": "4.5.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "com.pubnub:pubnub-kotlin",
    "versions": [
      {
        "version": "0",
        "lessThan": "7.7.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub/swift",
    "versions": [
      {
        "version": "0",
        "lessThan": "6.2.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "PubNub",
    "versions": [
      {
        "version": "0",
        "lessThan": "5.2.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "pubnub",
    "versions": [
      {
        "version": "0",
        "lessThan": "4.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
security	www.security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
gist	www.gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0
github	www.github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70
security	www.security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
github	www.github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
security	www.security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
security	www.security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
security	www.security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
security	www.security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375

06 Dec 2023 05:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.9

EPSS0.00955