Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/tinfoil-factory/netfoil >= 0.3.0, < 0.6.1
Fixed in
0.6.1· Vendor fix available
Issue
TTL was not decremented, so stale records would continue to be served.
Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
Recommended action: Upgrade to 0.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped. Impact Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Domain names were written to the log without first being validated to contain allowed characters. Impact Depends on how the logs were used.
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate. Impact Depends on a local attackers ability to craft multiple questions and the remote DoH server supporting them.
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binary.
Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com. Details Off-by-one error in the suffixtrie implementation. Impact The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.
Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.