Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-94v7-wxj6-r2q5

MediumCVSS 5.9 / 10
Published May 28, 2025·Last modified May 28, 2025
Affected Components(0)

No affected components available

Description

Impact

  • Some source-builds may be impacted by a CWE-1395 (eg. vulnerable setuptools dependency).
    • Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use setuptools <78.1.1 and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.

Patches

  • Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to setuptools>=80.4
    • Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0

Workarounds

  • Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.

References

Fixes

  • https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32
  • https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27
  • https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26
  • https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2
Risk Scores
Base Score
5.9

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights.

Threat Intelligence
2.1

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Medium severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard