PT-2023-20533 · Pubnub · Com.Pubnub:Pubnub+7

Varga Daniel · Publicado 2023-12-05 · Atualizado 2025-08-20 · CVE-2023-26154

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pubnub versions prior to 7.4.0 com.pubnub:pubnub all versions github.com/pubnub/go all versions github.com/pubnub/go/v7 versions prior to 7.2.0 pubnub/pubnub versions prior to 6.1.0 pubnub/c-core versions prior to 4.5.0 com.pubnub:pubnub-kotlin versions prior to 7.7.0 pubnub/swift versions prior to 6.2.0

Description The issue is related to insufficient entropy in the implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. This is due to the inefficient implementation of the getKey function. To exploit this vulnerability, an attacker needs to invest resources in preparing the attack and brute-force the encryption.

Recommendations To resolve the issue, users are encouraged to migrate to the new crypto package introduced in v7.2.0. For versions prior to 7.4.0, consider updating to version 7.4.0 or later. For com.pubnub:pubnub, github.com/pubnub/go, and other affected packages without a specified fixed version, update to the latest version available. As a temporary workaround, consider restricting the use of the vulnerable getKey function until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-331

Identificadores relacionados

CVE-2023-26154

GHSA-5844-Q3FC-56RH

GO-2023-2385

OPENSUSE-SU-2025:15469-1

Produtos afetados

Com.Pubnub:Pubnub

Com.Pubnub:Pubnub-Kotlin

Github.Com/Pubnub/Go

Github.Com/Pubnub/Go/V7

Pubnub

Pubnub/C-Core

Pubnub/Pubnub

Pubnub/Swift

Referências · 48

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml · Exploit
• 🔥 https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 · Exploit
• https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70 · Nota
• https://github.com/pubnub/javascript · Nota
• https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 · Correção
• https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 · Nota
• https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08 · Nota
• https://suse.com/security/cve/CVE-2025-53514 · Nota
• https://twitter.com/CVEnew/status/1732267368665993436 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-26154 · Nota de Segurança
• https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385 · Nota
• https://suse.com/security/cve/CVE-2025-44001 · Nota
• https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379 · Nota
• https://suse.com/security/cve/CVE-2025-54478 · Nota
• https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 · Nota