{"id":"GHSA-94v7-wxj6-r2q5","aliases":[],"status":"published","title":"multicast in source builds from vulnerable setuptools dependency","description":"### Impact\n * Some source-builds may be impacted by a CWE-1395 (eg. vulnerable `setuptools` dependency).\n   * Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use `setuptools \u003c78.1.1` and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.\n\n### Patches\n * Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to `setuptools\u003e=80.4`\n   * Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0\n\n### Workarounds\n * Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.\n\n### References\n* [GHSA-5rjg-fvgr-3xxf](https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)\n* pypa/setuptools#4946\n\n### Fixes\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395"],"published":"2025-05-28T21:07:05Z","modified":"2025-05-28T21:39:30Z","fixes":[{"ecosystem":"PyPI","package":"multicast","fixed_in":["2.0.9a0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"multicast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9a0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"multicast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9a0"}]}],"versions":["0.4","0.4.1","2.0.8"]}],"references":[{"url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/security/advisories/GHSA-94v7-wxj6-r2q5","tags":["web"]},{"url":"https://github.com/pypa/setuptools/issues/4946","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/commit/c5c7c7de272421d944beca8452871bca6bfd151f","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26","tags":["web"]},{"url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32","tags":["web"]},{"url":"https://github.com/advisories/GHSA-94v7-wxj6-r2q5"},{"url":"https://github.com/reactive-firewall/multicast","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-94v7-wxj6-r2q5","title":"multicast in source builds from vulnerable setuptools dependency","description":"### Impact\n * Some source-builds may be impacted by a CWE-1395 (eg. vulnerable `setuptools` dependency).\n   * Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use `setuptools \u003c78.1.1` and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.\n\n### Patches\n * Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to `setuptools\u003e=80.4`\n   * Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0\n\n### Workarounds\n * Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.\n\n### References\n* [GHSA-5rjg-fvgr-3xxf](https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)\n* pypa/setuptools#4946\n\n### Fixes\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","status":"published","published":"2025-05-28T21:07:05Z","modified":"2025-05-28T21:07:06Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"osv":[{"id":"GHSA-94v7-wxj6-r2q5","title":"multicast in source builds from vulnerable setuptools dependency","description":"### Impact\n * Some source-builds may be impacted by a CWE-1395 (eg. vulnerable `setuptools` dependency).\n   * Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use `setuptools \u003c78.1.1` and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.\n\n### Patches\n * Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to `setuptools\u003e=80.4`\n   * Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0\n\n### Workarounds\n * Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.\n\n### References\n* [GHSA-5rjg-fvgr-3xxf](https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)\n* pypa/setuptools#4946\n\n### Fixes\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","status":"published","published":"2025-05-28T21:07:05Z","modified":"2025-05-28T21:39:30.86103Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}