CVE - CVE-2023-26154

CVE-ID
CVE-2023-26154	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. Note: In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 URL:https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 MISC:https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 URL:https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 MISC:https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 URL:https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 MISC:https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 URL:https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 MISC:https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372 URL:https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372 MISC:https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373 URL:https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373 MISC:https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374 URL:https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374 MISC:https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371 URL:https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371 MISC:https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380 URL:https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380 MISC:https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690 URL:https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690 MISC:https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376 URL:https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376 MISC:https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385 URL:https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385 MISC:https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375 URL:https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375 MISC:https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377 URL:https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377 MISC:https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378 URL:https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378 MISC:https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381 URL:https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381 MISC:https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379 URL:https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
Assigning CNA
Snyk
Date Record Created
20230220	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230220)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)