Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-5844-Q3FC-56RH
HistoryDec 06, 2023 - 6:30 a.m.

pubnub Insufficient Entropy vulnerability

2023-12-0606:30:20
CWE-331
GitHub Advisory Database
github.com
9
pubnub
insufficient entropy
getkey function
aes-256-cbc
cryptographic algorithm
exploit
encryption
vulnerability
brute-force

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.9%

JSON

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.

Note:

In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.

Affected configurations

Vulners
Node
pubnubswiftRange<6.2.0
OR
pubnubpubnubRange<7.3.0
OR
pubnubpubnubRange<4.3.0
OR
pubnubpubnubRange<6.1.0
OR
pubnubpubnubRange<0.4.0
OR
pubnubpubnubRange<5.3.0
OR
pubnubpubnubRange<6.19.0
OR
pubnubpubnubRange≤5.0.3go
OR
pubnubpubnubRange≤6.1.0go
OR
pubnubpubnubRange≤4.10.0go
OR
pubnubpubnubRange<7.2.0go
OR
com.pubnub\Matchpubnub
OR
com.pubnub\pubnubMatchkotlin
OR
pubnubpubnubRange<7.4.0

References

Related

prion 1
cvelist 1
nvd 1
osv 3
cve 1
veracode 1
prion
prion
Design/Logic Flaw
2023-12-06 05:15:00
cvelist
cvelist
CVE-2023-26154
2023-12-06 05:00:02
nvd
nvd
CVE-2023-26154
2023-12-06 05:15:10
osv
osv
pubnub Insufficient Entropy vulnerability
2023-12-06 06:30:20
Insufficient entropy in AES-256-CBC in github.com/pubnub/go
2024-01-02 18:32:37
CVE-2023-26154
2023-12-06 05:15:10
cve
cve
CVE-2023-26154
2023-12-06 05:15:10
veracode
veracode
Insufficient Entropy
2023-12-08 04:02:55

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.9%

JSON
Related for GHSA-5844-Q3FC-56RH
prion1cvelist1nvd1osv3cve1veracode1