{"id":"GHSA-94v7-wxj6-r2q5","summary":"multicast in source builds from vulnerable setuptools dependency","details":"### Impact\n * Some source-builds may be impacted by a CWE-1395 (eg. vulnerable `setuptools` dependency).\n   * Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use `setuptools \u003c78.1.1` and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.\n\n### Patches\n * Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to `setuptools\u003e=80.4`\n   * Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0\n\n### Workarounds\n * Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.\n\n### References\n* [GHSA-5rjg-fvgr-3xxf](https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)\n* pypa/setuptools#4946\n\n### Fixes\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","modified":"2025-05-28T21:39:30.861030Z","published":"2025-05-28T21:07:05Z","database_specific":{"github_reviewed_at":"2025-05-28T21:07:05Z","nvd_published_at":null,"cwe_ids":["CWE-1395"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/security/advisories/GHSA-94v7-wxj6-r2q5"},{"type":"WEB","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/commit/c5c7c7de272421d944beca8452871bca6bfd151f"},{"type":"PACKAGE","url":"https://github.com/reactive-firewall/multicast"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32"}],"affected":[{"package":{"name":"multicast","ecosystem":"PyPI","purl":"pkg:pypi/multicast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9a0"}]}],"versions":["0.4","0.4.1","2.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-94v7-wxj6-r2q5/GHSA-94v7-wxj6-r2q5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}