sing-box vulnerable to improper authentication in the SOCKS inbound

緊急 9.8CVE-2023-43644 · GHSA-r5hm-mp3j-285g · GO-2023-2077 · 25/09/2023 公開 · 17/06/2026 更新

要点

CVE-2023-43644 は github.com/sagernet/sing, github.com/sagernet/sing-box, sing-box (sagernet) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.82%（全脆弱性の 57.6% より高い）。
対処：0.2.12-0.20230925092853-5b05b5c147d9, 1.5.0-rc.5, 1.4.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/sagernet/sing Go	`< 0.2.12-0.20230925092853-5b05b5c147d9`	`0.2.12-0.20230925092853-5b05b5c147d9`
github.com/sagernet/sing-box Go	`≥ 1.5.0-beta.1, < 1.5.0-rc.5< 1.4.5`	`1.5.0-rc.51.4.5`
sing-box sagernet	`= 1.5.0< 1.4.5`	`1.4.5`

概要

Impact

This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication.

Patches

Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions.

Workarounds

Don't expose the SOCKS5 inbound to insecure environments.

NVD の説明

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.