CVE-2023-43644: Missing Authentication for Critical Function
(updated )
Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.
References
- github.com/SagerNet/sing-box/commit/9891fd672f5da9f20f59a1693271a946727f49e2
- github.com/SagerNet/sing-box/releases/tag/v1.4.5
- github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g
- github.com/SagerNet/sing/commit/5b05b5c147d9650e8accb4441e216c72a61f4859
- github.com/advisories/GHSA-r5hm-mp3j-285g
- nvd.nist.gov/vuln/detail/CVE-2023-43644
Code Behaviors & Features
Detect and mitigate CVE-2023-43644 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →