GHSA-r5hm-mp3j-285gCriticalCVSS 9.1

sing-box vulnerable to improper authentication in the SOCKS inbound

Published
September 26, 2023
Last Modified
November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-43644 →

📋 Description

Impact

This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication.

Patches

Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions.

Workarounds

Don't expose the SOCKS5 inbound to insecure environments.

🎯 Affected products3

  • go/github.com/sagernet/sing-box:< 1.4.5
  • go/github.com/sagernet/sing-box:>= 1.5.0-beta.1, < 1.5.0-rc.5
  • go/github.com/sagernet/sing:< 0.2.12-0.20230925092853-5b05b5c147d9

🔗 References (6)