Threats affecting pkg:brew/dnsviz

A vulnerability in setuptools on Windows allows an attacker to craft a wheel with a malicious .dist-info/namespace_packages.txt file that causes setuptools' legacy wheel installation to create an __init__.py file outside the intended installation directory. This occurs because the namespace package path can be interpreted as an absolute Windows path, bypassing expected directory constraints. The created __init__.py file contains fixed content and is created with the permissions of the installing process. The attack requires the target parent directory to already exist.

A vulnerability in dnsviz's use of dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications handling untrusted DNS wire format messages. The issue is fixed in dnsviz version 0.11.2_1.