CVE-2024-4032: Incorrect IPv4 and IPv6 private ranges
Incorrect IPv4 and IPv6 private ranges
Other sources
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the 'isprivate' and 'isglobal' properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.
CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
References: https://github.com/python/cpython/issues/113171 https://github.com/python/cpython/pull/113179 https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
— Red Hat
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.
CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/CPythonto a version that resolves this vulnerability.Fixed in 3.12.4 - Upgrade
Upgrade
redhat/CPythonto a version that resolves this vulnerability.Fixed in 3.13.0 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.10.15-r0 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.11.10-r0 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.12.6-r0 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.18+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.12.4 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.13.0a6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4032?
CVE-2024-4032 is considered a moderate severity vulnerability affecting the ipaddress module's classification of IPv4 and IPv6 addresses.
How do I fix CVE-2024-4032?
To fix CVE-2024-4032, ensure you upgrade to the appropriate versions of CPython or Python as specified in the vulnerability report.
What versions of CPython are affected by CVE-2024-4032?
CVE-2024-4032 affects CPython versions below 3.12.4 and 3.13.0.
Is Python 3.9 impacted by CVE-2024-4032?
Yes, Python 3.9 is impacted by CVE-2024-4032 if it is up to version 3.9.2-1.
Which properties of the ipaddress module are affected by CVE-2024-4032?
CVE-2024-4032 affects the 'is_private' and 'is_global' properties of the ipaddress.IPv4Address and ipaddress.IPv6Address classes.