CVE-2023-43644: 
NixOS vulnerability analysis and mitigation

Sing-box, an open source proxy system, was found to contain an authentication bypass vulnerability (CVE-2023-43644) discovered in September 2023. The vulnerability affects all SOCKS5 inbounds with user authentication in versions prior to 1.4.5 and 1.5.0-rc.5 (GitHub Advisory).

The vulnerability allows attackers to bypass authentication when specially crafted requests are sent to sing-box's SOCKS5 inbound service. The issue has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high-severity vulnerability that requires no privileges or user interaction to exploit (NVD).

An attacker can bypass authentication mechanisms in SOCKS5 inbounds where user authentication is enabled. This could potentially lead to unauthorized access to the proxy service and compromise of the system's security controls (GitHub Advisory).

Users are advised to update to sing-box version 1.4.5 or 1.5.0-rc.5 and later versions. For users unable to update immediately, it is recommended not to expose the SOCKS5 inbound to insecure environments as a temporary workaround (GitHub Advisory).