gsd-2023-26154
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
Aliases
Aliases
CVE-2023-26154


To clipboard 

{
  "GSD": {
    "alias": "CVE-2023-26154",
    "id": "GSD-2023-26154"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-26154"
      ],
      "details": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.",
      "id": "GSD-2023-26154",
      "modified": "2023-12-13T01:20:53.808161Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "report@snyk.io",
        "ID": "CVE-2023-26154",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "pubnub",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "7.4.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "com.pubnub:pubnub",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "*"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Pubnub",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "6.19.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "github.com/pubnub/go",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "*"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "github.com/pubnub/go/v7",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "7.2.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "pubnub/pubnub",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "6.1.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "pubnub/c-core",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "4.5.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "com.pubnub:pubnub-kotlin",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "7.7.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "pubnub/swift",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "6.2.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "PubNub",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "5.2.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Varga Daniel"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-331",
                "lang": "eng",
                "value": "Insufficient Entropy"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384"
          },
          {
            "name": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385"
          },
          {
            "name": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0",
            "refsource": "MISC",
            "url": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0"
          },
          {
            "name": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70",
            "refsource": "MISC",
            "url": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70"
          },
          {
            "name": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119",
            "refsource": "MISC",
            "url": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.19.0",
                "versionStartIncluding": "6.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.1.0",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.2.0",
                "versionStartIncluding": "4.3.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.3.0",
                "versionStartIncluding": "3.6.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:c-core:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:kotlin:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:swift:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:go:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.3.0",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.4.0",
                "versionStartIncluding": "7.3.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "ID": "CVE-2023-26154"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-331"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384"
            },
            {
              "name": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385"
            },
            {
              "name": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0",
              "refsource": "",
              "tags": [
                "Exploit",
                "Issue Tracking"
              ],
              "url": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0"
            },
            {
              "name": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70",
              "refsource": "",
              "tags": [
                "Broken Link"
              ],
              "url": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70"
            },
            {
              "name": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119",
              "refsource": "",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-12-11T17:48Z",
      "publishedDate": "2023-12-06T05:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.