GHSA-94v7-wxj6-r2q5

Suggest an improvement
Source
https://github.com/advisories/GHSA-94v7-wxj6-r2q5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-94v7-wxj6-r2q5/GHSA-94v7-wxj6-r2q5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-94v7-wxj6-r2q5
Published
2025-05-28T21:07:05Z
Modified
2025-05-28T21:39:30Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
multicast in source builds from vulnerable setuptools dependency
Details

Impact

  • Some source-builds may be impacted by a CWE-1395 (eg. vulnerable setuptools dependency).
    • Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use setuptools <78.1.1 and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.

Patches

  • Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to setuptools>=80.4
    • Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0

Workarounds

  • Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.

References

Fixes

Database specific 
{
    "cwe_ids":  [
        "CWE-1395"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-05-28T21:07:05Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / multicast

Package

Name
multicast
View open source insights on deps.dev
Purl
pkg:pypi/multicast

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.9a0

Affected versions

0.*
0.4
0.4.1
2.*
2.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-94v7-wxj6-r2q5/GHSA-94v7-wxj6-r2q5.json"