Bug 2292921 (CVE-2024-4032) - CVE-2024-4032 python: incorrect IPv4 and IPv6 private ranges
Summary: CVE-2024-4032 python: incorrect IPv4 and IPv6 private ranges
Keywords:
Status: NEW
Alias: CVE-2024-4032
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2293387 2293389 2293390 2293391 2293392 2293393 2293394 2293395 2293396 2293397
Blocks: 2292923
TreeView+ depends on / blocked
 
Reported: 2024-06-18 16:50 UTC by Robb Gatica
Modified: 2026-07-18 08:28 UTC (History)
31 users (show)

Fixed In Version: CPython 3.12.4, CPython 3.13.0a6
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:6415 0 None None None 2024-09-05 09:35:35 UTC
Red Hat Product Errata RHBA-2024:7035 0 None None None 2024-09-24 08:31:59 UTC
Red Hat Product Errata RHBA-2024:7046 0 None None None 2024-09-24 11:15:11 UTC
Red Hat Product Errata RHBA-2024:7047 0 None None None 2024-09-24 11:51:38 UTC
Red Hat Product Errata RHBA-2024:7093 0 None None None 2024-09-25 02:21:04 UTC
Red Hat Product Errata RHBA-2024:7119 0 None None None 2024-09-25 14:26:30 UTC
Red Hat Product Errata RHBA-2024:7154 0 None None None 2024-09-25 21:25:15 UTC
Red Hat Product Errata RHBA-2024:7155 0 None None None 2024-09-25 21:25:31 UTC
Red Hat Product Errata RHBA-2024:7157 0 None None None 2024-09-25 23:53:43 UTC
Red Hat Product Errata RHBA-2024:7158 0 None None None 2024-09-25 23:53:57 UTC
Red Hat Product Errata RHBA-2024:7388 0 None None None 2024-09-30 14:35:32 UTC
Red Hat Product Errata RHBA-2024:7560 0 None None None 2024-10-02 21:02:20 UTC
Red Hat Product Errata RHBA-2024:7569 0 None None None 2024-10-03 00:31:53 UTC
Red Hat Product Errata RHBA-2024:7627 0 None None None 2024-10-03 12:11:52 UTC
Red Hat Product Errata RHBA-2024:7630 0 None None None 2024-10-03 13:22:42 UTC
Red Hat Product Errata RHBA-2024:7631 0 None None None 2024-10-03 13:31:56 UTC
Red Hat Product Errata RHBA-2024:7754 0 None None None 2024-10-07 13:41:55 UTC
Red Hat Product Errata RHBA-2024:7857 0 None None None 2024-10-09 12:02:06 UTC
Red Hat Product Errata RHSA-2024:4766 0 None None None 2024-07-23 16:23:29 UTC
Red Hat Product Errata RHSA-2024:4779 0 None None None 2024-07-23 16:24:19 UTC
Red Hat Product Errata RHSA-2024:5962 0 None None None 2024-08-28 18:52:00 UTC
Red Hat Product Errata RHSA-2024:6030 0 None None None 2024-08-29 11:48:15 UTC
Red Hat Product Errata RHSA-2024:6961 0 None None None 2024-09-24 00:48:31 UTC
Red Hat Product Errata RHSA-2024:6962 0 None None None 2024-09-24 00:48:51 UTC
Red Hat Product Errata RHSA-2024:6975 0 None None None 2024-09-24 02:58:35 UTC
Red Hat Product Errata RHSA-2024:7417 0 None None None 2024-10-01 00:40:30 UTC
Red Hat Product Errata RHSA-2024:9190 0 None None None 2024-11-12 09:04:09 UTC

Description Robb Gatica 2024-06-18 16:50:01 UTC 
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the 'is_private' and 'is_global' properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

References:
https://github.com/python/cpython/issues/113171
https://github.com/python/cpython/pull/113179
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
Comment 1 Robb Gatica 2024-06-20 14:50:59 UTC 
Created mingw-python3 tracking bugs for this issue:

Affects: fedora-all [bug 2293389]


Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2293390]


Created python3.11 tracking bugs for this issue:

Affects: fedora-all [bug 2293391]


Created python3.12 tracking bugs for this issue:

Affects: fedora-all [bug 2293392]


Created python3.13 tracking bugs for this issue:

Affects: fedora-all [bug 2293393]


Created python3.6 tracking bugs for this issue:

Affects: fedora-all [bug 2293394]


Created python3.7 tracking bugs for this issue:

Affects: fedora-all [bug 2293395]


Created python3.8 tracking bugs for this issue:

Affects: fedora-all [bug 2293396]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2293397]


Created python34 tracking bugs for this issue:

Affects: epel-all [bug 2293387]
Comment 6 errata-xmlrpc 2024-07-23 16:23:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4766 https://access.redhat.com/errata/RHSA-2024:4766
Comment 7 errata-xmlrpc 2024-07-23 16:24:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4779 https://access.redhat.com/errata/RHSA-2024:4779
Comment 8 errata-xmlrpc 2024-08-28 18:51:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5962 https://access.redhat.com/errata/RHSA-2024:5962
Comment 9 errata-xmlrpc 2024-08-29 11:48:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:6030 https://access.redhat.com/errata/RHSA-2024:6030
Comment 10 errata-xmlrpc 2024-09-24 00:48:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6961 https://access.redhat.com/errata/RHSA-2024:6961
Comment 11 errata-xmlrpc 2024-09-24 00:48:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6962 https://access.redhat.com/errata/RHSA-2024:6962
Comment 12 errata-xmlrpc 2024-09-24 02:58:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6975 https://access.redhat.com/errata/RHSA-2024:6975
Comment 13 errata-xmlrpc 2024-10-01 00:40:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:7417 https://access.redhat.com/errata/RHSA-2024:7417
Comment 16 errata-xmlrpc 2024-11-12 09:04:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9190 https://access.redhat.com/errata/RHSA-2024:9190
Note You need to log in before you can comment on or make changes to this bug.