pubnub Insufficient Entropy vulnerability
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.
Note:
In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | pubnub/pubnub | < 6.1.0 | 6.1.0 |
| Java / Kotlin (Maven) | com.pubnub:pubnub | <= 4.6.5 | sin corrección |
| Java / Kotlin (Maven) | com.pubnub:pubnub-kotlin | < 7.7.0 | 7.7.0 |
| Paquete de npm | pubnub | < 7.4.0 | 7.4.0 |
| .NET (NuGet) | Pubnub | < 6.19.0 | 6.19.0 |
| Python (PyPI) | pubnub | < 7.3.0 | 7.3.0 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2023-26154
- https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08
- https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
- https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
- https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
- https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
- https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
- https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375
- https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
- https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376
- https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690
- https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380
- https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373
- https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
- https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml
- https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70
- https://github.com/pubnub/javascript
- https://github.com/advisories/GHSA-5844-q3fc-56rh
- https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0
- https://pypi.org/project/pubnub
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-331- Plataforma
- Composer, Java / Kotlin (Maven), npm, .NET (NuGet), Python (PyPI)
- Paquete
pubnub/pubnub, com.pubnub:pubnub, com.pubnub:pubnub-kotlin- Publicada
- 06.12.2023
- Actualizado
- 11.10.2026 13:18
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-5844-q3fc-56rh - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-1807 - PyPA Advisory Database; CC BY 4.0
Historial de vulnerabilidades: Pubnub
Todas las vulnerabilidades publicadas de este paquete (.NET (NuGet)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.