HIGH
GHSA-xvg2-cgv6-6h7v
netfoil: Incorrect block responses could lead to localhost traffic
Quick fix
GHSA-xvg2-cgv6-6h7v — github.com/tinfoil-factory/netfoil: upgrade to the fixed version with the command below.
go get github.com/tinfoil-factory/netfoil@v0.4.0Details
### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.
### Impact Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/tinfoil-factory/netfoil
Introduced in:
0 Fixed in: 0.4.0 Fix
go get github.com/tinfoil-factory/netfoil@v0.4.0 References
- https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v [WEB]
- https://github.com/tinfoil-factory/netfoil/pull/33 [WEB]
- https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448 [WEB]
- https://github.com/tinfoil-factory/netfoil [PACKAGE]
- https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0 [WEB]