Insufficient Entropy

pubnub is vulnerable to Insufficient Entropy. The vulnerability is caused by the getKey function in web.js which uses an inefficient key derivation method for AES-256-CBC encryption, resulting in a reduced key space due to hex encoding and trimming. This leaves half of the bits in the encryption key fixed for all messages, This allows attackers to brute-force the encryption by exploiting the limited entropy in the key generation process.