{"id":"GHSA-94v7-wxj6-r2q5","aliases":[],"url":"https://o3.security/vulnerability/GHSA-94v7-wxj6-r2q5","summary":"multicast in source builds from vulnerable setuptools dependency","details":"### Impact\n * Some source-builds may be impacted by a CWE-1395 (eg. vulnerable `setuptools` dependency).\n   * Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use `setuptools <78.1.1` and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.\n\n### Patches\n * Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to `setuptools>=80.4`\n   * Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0\n\n### Workarounds\n * Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.\n\n### References\n* [GHSA-5rjg-fvgr-3xxf](https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)\n* pypa/setuptools#4946\n\n### Fixes\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26\n* https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2","published":"2025-05-28T21:07:05Z","modified":"2025-05-28T21:39:30.861030Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"multicast","fixedVersion":"2.0.9a0"}],"fix":{"url":"https://github.com/reactive-firewall/multicast/commit/c5c7c7de272421d944beca8452871bca6bfd151f","label":"reactive-firewall/multicast@c5c7c7d"},"references":[{"type":"WEB","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/security/advisories/GHSA-94v7-wxj6-r2q5"},{"type":"WEB","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/commit/c5c7c7de272421d944beca8452871bca6bfd151f"},{"type":"PACKAGE","url":"https://github.com/reactive-firewall/multicast"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26"},{"type":"WEB","url":"https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-05-28T21:39:30.861030Z"}}