critical9.1
CVE-2023-43644
sing-box vulnerable to improper authentication in the SOCKS inbound
Impact
### Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. ### Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. ### Workarounds Don't expose the SOCKS5 inbound to insecure environments.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/sagernet/sing-box | < 1.4.5 | 1.4.5 |
| go | github.com/sagernet/sing | < 0.2.12-0.20230925092853-5b05b5c147d9 | 0.2.12-0.20230925092853-5b05b5c147d9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sagernet | Sing-Box | before 1.4.5 Version 1.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g
- https://github.com/advisories/GHSA-r5hm-mp3j-285g
- https://nvd.nist.gov/vuln/detail/CVE-2023-43644
- https://github.com/SagerNet/sing-box/commit/9891fd672f5da9f20f59a1693271a946727f49e2
- https://github.com/SagerNet/sing-box/releases/tag/v1.4.5
- https://github.com/SagerNet/sing/commit/5b05b5c147d9650e8accb4441e216c72a61f4859