CVE-2023-43644
25.09.2023, 20:15
Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.Enginsight
| Vendor | Product | Version |
|---|---|---|
| sagernet | sing-box | 𝑥 < 1.4.5 |
| sagernet | sing-box | 1.5.0:beta1 |
| sagernet | sing-box | 1.5.0:beta10 |
| sagernet | sing-box | 1.5.0:beta11 |
| sagernet | sing-box | 1.5.0:beta12 |
| sagernet | sing-box | 1.5.0:beta2 |
| sagernet | sing-box | 1.5.0:beta3 |
| sagernet | sing-box | 1.5.0:beta4 |
| sagernet | sing-box | 1.5.0:beta5 |
| sagernet | sing-box | 1.5.0:beta6 |
| sagernet | sing-box | 1.5.0:beta7 |
| sagernet | sing-box | 1.5.0:beta8 |
| sagernet | sing-box | 1.5.0:beta9 |
| sagernet | sing-box | 1.5.0:rc1 |
| sagernet | sing-box | 1.5.0:rc2 |
| sagernet | sing-box | 1.5.0:rc3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration