Medium
multicast in source builds from vulnerable setuptools dependency
Impact
- Some source-builds may be impacted by a CWE-1395 (eg. vulnerable
setuptoolsdependency).- Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use
setuptools <78.1.1and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.
- Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use
Patches
- Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to
setuptools>=80.4- Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0
Workarounds
- Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.
References
- GHSA-5rjg-fvgr-3xxf
- pypa/setuptools#4946
Fixes
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | multicast | < 2.0.9a0 | 2.0.9a0 |
References
- https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
- https://github.com/reactive-firewall/multicast/security/advisories/GHSA-94v7-wxj6-r2q5
- https://github.com/pypa/setuptools/issues/4946
- https://github.com/reactive-firewall/multicast/commit/c5c7c7de272421d944beca8452871bca6bfd151f
- https://github.com/reactive-firewall/multicast
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26
- https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32
CVSS score
-
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-1395- Platform
- Python (PyPI)
- Package
multicast- Disclosed
- 28.05.2025
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-94v7-wxj6-r2q5 - CC BY 4.0
Vulnerability history: multicast
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.