GHSA-5844-q3fc-56rh CVE-2023-26154 GO-2023-2385 PYSEC-2026-1807
pubnub Insufficient Entropy vulnerability
- Severity
- 5.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.96%
- Chance of exploitation in the next 30 days. Higher than 61.68% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-331 Insufficient Entropy
- Fix
- Available
- 13 packages have a fixed version
Description
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.
Note:
In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/pubnub/go | < 0.0.0-20231016150651-428517fef5b9 |
0.0.0-20231016150651-428517fef5b9 |
| github.com/pubnub/go | all versions |
No fix yet |
| github.com/pubnub/go/v5 | < 5.0.4-0.20231016150651-428517fef5b9 |
5.0.4-0.20231016150651-428517fef5b9 |
| github.com/pubnub/go/v5 | all versions |
No fix yet |
| github.com/pubnub/go/v6 | < 6.1.1-0.20231016150651-428517fef5b9 |
6.1.1-0.20231016150651-428517fef5b9 |
| github.com/pubnub/go/v6 | all versions |
No fix yet |
| github.com/pubnub/go/v7 | < 7.2.0 |
7.2.0 |
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.pubnub:pubnub | <= 4.6.5 |
No fix yet |
| com.pubnub:pubnub-kotlin | < 7.7.0 |
7.7.0 |
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| Pubnub | < 6.19.0 |
6.19.0 |
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub/pubnub | < 6.1.0 |
6.1.0 |
Pub
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub | < 4.3.0 |
4.3.0 |
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub | < 7.3.0 |
7.3.0 |
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub | < 5.3.0 |
5.3.0 |
SwiftURL
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/pubnub/swift | < 6.2.0 |
6.2.0 |
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub | < 0.4.0 |
0.4.0 |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| pubnub | < 7.4.0 |
7.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/pubnub/go Go → 0.0.0-20231016150651-428517fef5b9
- go
go get github.com/pubnub/go@v0.0.0-20231016150651-428517fef5b9 && go mod tidy
github.com/pubnub/go/v5 Go → 5.0.4-0.20231016150651-428517fef5b9
- go
go get github.com/pubnub/go/v5@v5.0.4-0.20231016150651-428517fef5b9 && go mod tidy
github.com/pubnub/go/v6 Go → 6.1.1-0.20231016150651-428517fef5b9
- go
go get github.com/pubnub/go/v6@v6.1.1-0.20231016150651-428517fef5b9 && go mod tidy
github.com/pubnub/go/v7 Go → 7.2.0
- go
go get github.com/pubnub/go/v7@v7.2.0 && go mod tidy
com.pubnub:pubnub-kotlin Maven → 7.7.0
- maven
<dependency><groupId>com.pubnub</groupId><artifactId>pubnub-kotlin</artifactId><version>7.7.0</version></dependency>- gradle
implementation("com.pubnub:pubnub-kotlin:7.7.0")
Pubnub NuGet → 6.19.0
- dotnet
dotnet add package Pubnub --version 6.19.0
pubnub/pubnub Packagist → 6.1.0
- composer
composer require pubnub/pubnub:^6.1.0
pubnub Pub → 4.3.0
- dart
dart pub add pubnub:^4.3.0
pubnub PyPI → 7.3.0
- pip
pip install --upgrade "pubnub>=7.3.0"- poetry
poetry add "pubnub>=7.3.0"- uv
uv add "pubnub>=7.3.0"
pubnub RubyGems → 5.3.0
- bundler
bundle update pubnub # Gemfile: gem "pubnub", ">= 5.3.0"
github.com/pubnub/swift SwiftURL → 6.2.0
Set github.com/pubnub/swift to 6.2.0 or later in your manifest.
pubnub crates.io → 0.4.0
- cargo
cargo update -p pubnub --precise 0.4.0
pubnub npm → 7.4.0
- npm
npm install pubnub@7.4.0- yarn
yarn add pubnub@7.4.0- pnpm
pnpm add pubnub@7.4.0
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How to prevent it
- Implementation: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
References
Advisories
Packages
Other links
- github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08
- github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
- security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
- security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
- security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
- security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
- security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375
- security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
- security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376
- security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690
- security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380
- security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
- security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374
- security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373
- security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
- security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384
- github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml
- github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js
- gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0
- github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p5jq-5383-qvc7 TYPO3 CMS uses insufficient entropy when generating passwords | Medium | Same weakness, CWE-331 |
| GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | High | Same weakness, CWE-331 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability | High | Same weakness, CWE-331 |
| GHSA-wqcc-qf63-c2x4 WWBN AVideo Insufficient Entropy vulnerbaility | Critical | Same weakness, CWE-331 |
| GHSA-8c69-r38j-rpfj Rancher cattle-token is predictable | Critical | Same weakness, CWE-331 |
| GHSA-2m7h-86qq-fp4v Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params | High | Same weakness, CWE-331 |
| GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider | Medium | Same weakness, CWE-331 |
| GHSA-rmw5-xpg9-jr29 Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone | High | Same weakness, CWE-331 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor