CVE-2024-4032

Incorrect IPv4 and IPv6 private ranges

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

El módulo "ipaddress" contenía información incorrecta sobre si ciertas direcciones IPv4 e IPv6 estaban designadas como "accesibles globalmente" o "privadas". Esto afectó las propiedades is_private e is_global de las clases ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address y ipaddress.IPv6Network, donde los valores no se devolverían de acuerdo con la información más reciente de los Registros de direcciones de propósito especial de la IANA. CPython 3.12.4 y 3.13.0a6 contienen información actualizada de estos registros y, por lo tanto, tienen el comportamiento previsto.

A flaw was found in Python. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. Due to this issue, it is possible that values will not be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-04-22 CVE Reserved
2024-06-17 CVE Published
2024-07-29 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-440: Expected Behavior Violation
CWE-697: Incorrect Comparison

CAPEC

References (15)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/06/17/3
https://github.com/python/cpython/issues/113171	Issue Tracking
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
https://security.netapp.com/advisory/ntap-20240726-0004

URL	Date	SRC

URL	Date	SRC
https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8	2024-06-20
https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f	2024-06-20
https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3	2024-06-20
https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb	2024-06-20
https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906	2024-06-20
https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3	2024-06-20
https://github.com/python/cpython/pull/113179	2024-06-20

URL	Date	SRC
https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA	2024-06-20
https://access.redhat.com/security/cve/CVE-2024-4032	2024-10-01
https://bugzilla.redhat.com/show_bug.cgi?id=2292921	2024-10-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				< 3.8.20 Search vendor "Python Software Foundation" for product "CPython" and version " < 3.8.20"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.9.0 < 3.9.20 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.9.0 < 3.9.20"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.10.0 < 3.10.15 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.10.0 < 3.10.15"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.11.0 < 3.11.10 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.11.0 < 3.11.10"		en		Affected
Python Software Foundation Search vendor "Python Software Foundation"		CPython Search vendor "Python Software Foundation" for product "CPython"				>= 3.12.0 < 3.12.4 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.12.0 < 3.12.4"		en		Affected