VRT
391,810 CVEs tracked ·
15,472 in RASP scope ·
data as of 32 minutes ago
VRT
391,810 CVEs tracked ·
15,472 in RASP scope ·
data as of 32 minutes ago
CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
CWE-331
No public exploit
Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 2 years.
CVSS E:U
In RASP's scope with an upstream fix path, but nobody has published a working exploit. That is a statement about what has been published, not a finding that the defect is unreachable or unimportant.
| Decided by | below-action-threshold : Medium or Low severity, no KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory |
|---|---|
| Finding | This CVE is MEDIUM severity, is not listed in CISA KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain. |
| Candidate fix | https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 : a commit: the change itself |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
VRT selects the newest version's highest entry and
publishes it as cvssScore, newest rather than largest because scores are not comparable
across versions, and highest rather than first because the first entry is frequently a CNA placeholder
scoring 0.0 over NVD's own analysis.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
report@snyk.io | Secondary | published |
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary |
| Package Coordinate | Introduced | Fixed | Last affected |
|---|---|---|---|
com.pubnub:pubnub-kotlin |
0 | 7.7.0 |
unbounded |
com.pubnub:pubnub |
0 | none | 4.6.5 |
| Source | Vendor | Product | Scheme | Affected Versions |
|---|---|---|---|---|
| osv | com.pubnub | pubnub | generic | ≤ 4.6.5 |
| osv | com.pubnub | pubnub-kotlin | generic | ＜ 7.7.0 |
| nvd | pubnub | c-core | generic | ＜ 4.5.0 |
| nvd | pubnub | kotlin | generic | ＜ 7.7.0 |
| nvd | pubnub | pubnub | generic | ＜ 0.4.0 · ≥ 3.6.4 and ＜ 4.3.0 · ≥ 4.3.1 and ＜ 5.2.0 · ≥ 6.0.0 and ＜ 6.1.0 · ≥ 6.2.0 and ＜ 6.19.0 · ≥ 7.0.0 and ＜ 7.3.0 · ＜ 7.2.0 · ≥ 7.3.1 and ＜ 7.4.0 |
| nvd | pubnub | swift | generic | ＜ 6.2.0 |
| Published | 2023-12-06 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |