Threats affecting pkg:brew/torrra

AnyIO's process-pool workers in the Torrra product do not properly drain stderr, causing a potential deadlock if too much data is written to stderr. This can block the worker process indefinitely, affecting users running untrusted or faulty code that writes extensively to stderr. The issue is fixed in version 2.1.0.

AnyIO's TLSStream uses IDNA 2003 encoding for internationalized domain names, which can enable TLS certificate spoofing. An attacker who hijacks and redirects a TLS connection to a malicious server can obtain a legitimate certificate for the IDNA 2003 encoded domain and present it to the client, causing the client to validate the malicious certificate. This vulnerability affects versions from 1.2.8 up to but not including 2.1.0 of the affected product. A patch is available in version 2.1.0, and a workaround involves manually encoding host names using the 'idna' package before connecting.