CVE-2023-26154 — Versions of the package pubnub before 7

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub

01What is this vulnerability?

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0…

02Affected products

Vendor	Product	Versions
n	a / pubnub	0
n	a / com.pubnub:pubnub	0
n	a / Pubnub	0
n	a / github.com/pubnub/go	0
n	a / github.com/pubnub/go/v7	0
n	a / pubnub	0
n	a / pubnub/pubnub	0
n	a / pubnub	0
n	a / pubnub	0
n	a / pubnub/c	core — 0
n	a / com.pubnub:pubnub	kotlin — 0
n	a / pubnub/swift	0
n	a / PubNub	0
n	a / pubnub	0

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-12-06T05:00:02.795Z
• Last modified: 2024-08-02T11:39:06.653Z

09References

• security.snyk.io — https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690
• security.snyk.io — https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
• security.snyk.io — https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
• security.snyk.io — https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373
• security.snyk.io — https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374
• security.snyk.io — https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375
• security.snyk.io — https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376
• security.snyk.io — https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
• security.snyk.io — https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
• security.snyk.io — https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
• security.snyk.io — https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380
• security.snyk.io — https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
• security.snyk.io — https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384
• security.snyk.io — https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
• gist.github.com — https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0
• github.com — https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70
• github.com — https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447…