HIGHCVSS 7.4
GHSA-xvg2-cgv6-6h7v
netfoil: Incorrect block responses could lead to localhost traffic
Summary
### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped. ### Impact Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Go | github.com/tinfoil-factory/netfoil | — | 0.4.0 |
Remediation: Upgrade to 0.4.0 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.