GHSA-4ph6-mjv7-3fq6: Go/github.com/tinfoil-factory/netfoil vulnerability
Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/tinfoil-factory/netfoilto a version that resolves this vulnerability.Fixed in 0.5.0
Event History
Frequently Asked Questions
What must an attacker control or influence to trigger the issue?
The attacker would need to cause the DoH server to return HTTPS RR data containing unverified APLN data or a crafted single-byte response code. Those returned values are written directly to the log.
How can potentially affected activity be recognized?
Review application logs for unexpected arbitrary byte sequences in logged HTTPS RR APLN data or unusual single-byte response-code output. The issue can also manifest as unnecessary memory usage while handling these responses.