GO-2023-2385
Insufficient entropy in AES-256-CBC in github.com/pubnub/go
Quick fix
GO-2023-2385 — github.com/pubnub/go/v7: upgrade to the fixed version with the command below.
go get github.com/pubnub/go/v7@v7.2.0Details
There is insufficient entropy in the implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt functions are less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.
Users are encouraged to migrate to the new crypto package introduced in v7.2.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/pubnub/go (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/pubnub/go/v5 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/pubnub/go/v6 (go modules). Pin to a known-safe version or switch to an alternative.