Threats affecting pkg:brew/specify

AnyIO's process-pool workers have a vulnerability where stderr is connected to a pipe that is never drained. This can cause the pipe to fill and block indefinitely if the worker writes enough data to stderr, leading to a deadlock in the process-pool call. The issue affects versions from 0.0.16 up to but not including 0.5.1. A fix is available in version 0.5.1. Closing sys.stderr in the target function can serve as a temporary workaround.

AnyIO versions from 0.0.16 up to but not including 0.5.1 use IDNA 2003 host name encoding in TLSStream, which can enable TLS certificate spoofing. An attacker who hijacks and redirects a TLS connection to a malicious server can present a legitimate certificate encoded with IDNA 2003, causing the client to validate it incorrectly. This vulnerability is critical and has a CVSS score of 9.3. The issue is fixed in version 0.5.1. As a workaround, host names can be encoded using the 'idna' package before connecting.