~ / search / GHSA-r5hm-mp3j-285g

GHSA-r5hm-mp3j-285g

sing-box vulnerable to improper authentication in the SOCKS inbound

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-43644

Packages

EcosystemPackageAffectedFixed in
Go github.com/sagernet/sing-box < 1.4.5 1.4.5
Go github.com/sagernet/sing-box >= 1.5.0-beta.1, < 1.5.0-rc.5 1.5.0-rc.5
Go github.com/sagernet/sing < 0.2.12-0.20230925092853-5b05b5c147d9 0.2.12-0.20230925092853-5b05b5c147d9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. ### Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. ### Workarounds Don't expose the SOCKS5 inbound to insecure environments.

References

External links from the advisory. They lead to third-party sites.