BIT-python-min-2024-4032: Incorrect IPv4 and IPv6 private ranges

Q: Which applications are most likely to be affected by this issue?

Applications that make security, access-control, routing, filtering, or trust decisions using the ipaddress module’s is_private or is_global properties may be affected. The issue applies to IPv4Address, IPv4Network, IPv6Address, and IPv6Network values.

Q: Can this be exploited remotely without authentication?

The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. Exploitation would depend on an application relying on the incorrect address classification when handling attacker-controlled IP addresses.

Q: Which CPython releases contain the corrected address-classification data?

CPython 3.12.4 and 3.13.0a6 contain updated IANA Special-Purpose Address Registry information and have the intended behavior.

Q: How can I determine whether an application is exposed?

Identify uses of ipaddress.IPv4Address, IPv4Network, IPv6Address, or IPv6Network that rely on is_private or is_global. Verify whether those decisions involve address ranges whose IANA special-purpose classification may have changed and whether the runtime includes the updated registry information.

Published Jun 17, 2024

Updated

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

Affected Software

1 affected component

Python Software Foundation CPython<3.12.4, <3.13.0a6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.12.4
Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.13.0a6

Event History

Jun 17, 2024

CVE Published

via OSV·03:05 PM

Data Sourced

via OSV·03:05 PM

DescriptionSeverity

Frequently Asked Questions

Which applications are most likely to be affected by this issue?

Applications that make security, access-control, routing, filtering, or trust decisions using the ipaddress module’s is_private or is_global properties may be affected. The issue applies to IPv4Address, IPv4Network, IPv6Address, and IPv6Network values.

Can this be exploited remotely without authentication?

The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. Exploitation would depend on an application relying on the incorrect address classification when handling attacker-controlled IP addresses.

Which CPython releases contain the corrected address-classification data?

CPython 3.12.4 and 3.13.0a6 contain updated IANA Special-Purpose Address Registry information and have the intended behavior.

How can I determine whether an application is exposed?

Identify uses of ipaddress.IPv4Address, IPv4Network, IPv6Address, or IPv6Network that rely on is_private or is_global. Verify whether those decisions involve address ranges whose IANA special-purpose classification may have changed and whether the runtime includes the updated registry information.

BIT-python-min-2024-4032: Incorrect IPv4 and IPv6 private ranges

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are most likely to be affected by this issue?

Can this be exploited remotely without authentication?

Which CPython releases contain the corrected address-classification data?

How can I determine whether an application is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which applications are most likely to be affected by this issue?

Can this be exploited remotely without authentication?

Which CPython releases contain the corrected address-classification data?

How can I determine whether an application is exposed?