CVE-2023-26154

Summary

CVE-2023-26154 affects multiple versions of the PubNub package and its derivatives, including those for Go, Kotlin, Swift, and C. The vulnerability lies in the getKey function's implementation of the AES-256-CBC cryptographic algorithm, which results in insufficient entropy. During the encryption process, hex encoding and trimming leave half of the bits in the key constant for every encoded message or file. While exploiting this vulnerability requires significant resources for brute-force attacks, users of impacted versions are advised to update to the latest, secure releases.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.