BIT-libpython-2024-4032: Incorrect IPv4 and IPv6 private ranges

Q: Which CPython releases contain the corrected address-classification data?

CPython 3.12.4 and 3.13.0a6 contain updated IANA Special-Purpose Address Registry information and provide the intended is_private and is_global behavior.

Q: What functionality should be reviewed for exposure?

Review code that relies on ipaddress.IPv4Address, IPv4Network, IPv6Address, or IPv6Network is_private or is_global properties to make security or routing decisions. Certain IPv4 and IPv6 addresses may have been classified contrary to current IANA registry information.

Published Jun 17, 2024

Updated

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

Affected Software

1 affected component

Python Software Foundation CPython<3.12.4, <3.13.0a6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.12.4
Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.13.0a6

Event History

Jun 17, 2024

CVE Published

via OSV·03:05 PM

Data Sourced

via OSV·03:05 PM

DescriptionSeverity

Frequently Asked Questions

Which CPython releases contain the corrected address-classification data?

CPython 3.12.4 and 3.13.0a6 contain updated IANA Special-Purpose Address Registry information and provide the intended is_private and is_global behavior.

What functionality should be reviewed for exposure?

Review code that relies on ipaddress.IPv4Address, IPv4Network, IPv6Address, or IPv6Network is_private or is_global properties to make security or routing decisions. Certain IPv4 and IPv6 addresses may have been classified contrary to current IANA registry information.

BIT-libpython-2024-4032: Incorrect IPv4 and IPv6 private ranges

Affected Software

Remediation

Event History

Frequently Asked Questions

Which CPython releases contain the corrected address-classification data?

What functionality should be reviewed for exposure?

Company

Resources

Contact

Frequently Asked Questions

Which CPython releases contain the corrected address-classification data?

What functionality should be reviewed for exposure?