GitHub Advisoryadvisory · Go

GHSA-r5hm-mp3j-285g sing-box vulnerable to improper authentication in the SOCKS inbound

CRITICAL Published 2023-09-26 Modified 2023-09-26 Official page ↗
Aliases
CVE-2023-43644
Ecosystem
Go
Packages
github.com/sagernet/sing-box, github.com/sagernet/sing
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-306
Reviewed
2023-09-26

Affected packages

• Go github.com/sagernet/sing-box: < 1.4.5 → fixed in 1.4.5 • Go github.com/sagernet/sing-box: >= 1.5.0-beta.1, < 1.5.0-rc.5 → fixed in 1.5.0-rc.5 • Go github.com/sagernet/sing: < 0.2.12-0.20230925092853-5b05b5c147d9 → fixed in 0.2.12-0.20230925092853-5b05b5c147d9

Description

Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments.

Related

Alias · CVE (1)

  • CVE-2023-43644 Sing-box is an open source proxy system. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References