Incorrect IPv4 and IPv6 private ranges
Priority MEDIUM 41CWE-697Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 17 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01079 65th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.8.20, 3.9.20, 3.10.15 +3Red Hat: 9 advisoriesRed Hat: 17 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.4; 3.13.0a1 to before 3.13.0a6 | 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0a6 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.4; 3.13.0a1 to before 3.13.0a6 Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0a6 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0a6
Red Hat 9 advisories
- RHSA-2024:9190 Released 2024-11-12 · Red Hat rating Moderatepython3.12 security update
- Red Hat CodeReady Linux Builder (v. 9) python3.12-3.12.5-2.el9, python3.12-debug-3.12.5-2.el9, python3.12-idle-3.12.5-2.el9 +2
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.5-2.el9, python3.12-devel-3.12.5-2.el9, python3.12-libs-3.12.5-2.el9 +1
- RHSA-2024:7417 Released 2024-10-01 · Red Hat rating Lowpython3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.7, platform-python-debug-3.6.8-47.el8_6.7, platform-python-devel-3.6.8-47.el8_6.7 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.6) platform-python-3.6.8-47.el8_6.7, platform-python-debug-3.6.8-47.el8_6.7, platform-python-devel-3.6.8-47.el8_6.7 +3
- Red Hat Enterprise Linux AppStream TUS (v.8.6) platform-python-3.6.8-47.el8_6.7, platform-python-debug-3.6.8-47.el8_6.7, platform-python-devel-3.6.8-47.el8_6.7 +3
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.7, python3-3.6.8-47.el8_6.7, python3-libs-3.6.8-47.el8_6.7 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-3.6.8-47.el8_6.7, python3-3.6.8-47.el8_6.7, python3-libs-3.6.8-47.el8_6.7 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-3.6.8-47.el8_6.7, python3-3.6.8-47.el8_6.7, python3-libs-3.6.8-47.el8_6.7 +1
- RHSA-2024:6975 Released 2024-09-24 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-67.el8_10, platform-python-debug-3.6.8-67.el8_10, platform-python-devel-3.6.8-67.el8_10 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-67.el8_10, python3-3.6.8-67.el8_10, python3-libs-3.6.8-67.el8_10 +1
Show 6 more Red Hat advisories
- RHSA-2024:6962 Released 2024-09-24 · Red Hat rating Moderatepython3.11 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.11-3.11.9-7.el8_10, python3.11-devel-3.11.9-7.el8_10, python3.11-libs-3.11.9-7.el8_10 +2
- Red Hat Enterprise Linux CRB (v. 8) python3.11-3.11.9-7.el8_10, python3.11-debug-3.11.9-7.el8_10, python3.11-idle-3.11.9-7.el8_10 +2
- RHSA-2024:6961 Released 2024-09-24 · Red Hat rating Moderatepython3.12 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.5-2.el8_10, python3.12-devel-3.12.5-2.el8_10, python3.12-libs-3.12.5-2.el8_10 +2
- Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.5-2.el8_10, python3.12-debug-3.12.5-2.el8_10, python3.12-idle-3.12.5-2.el8_10 +2
- RHSA-2024:6030 Released 2024-08-29 · Red Hat rating Lowpython3 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) platform-python-3.6.8-51.el8_8.7, platform-python-debug-3.6.8-51.el8_8.7, platform-python-devel-3.6.8-51.el8_8.7 +3
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) platform-python-3.6.8-51.el8_8.7, python3-3.6.8-51.el8_8.7, python3-libs-3.6.8-51.el8_8.7 +1
- RHSA-2024:5962 Released 2024-08-28 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- RHSA-2024:4766 Released 2024-07-23 · Red Hat rating Lowpython3 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.7-1.el9_4.3, python3.11-devel-3.11.7-1.el9_4.3, python3.11-libs-3.11.7-1.el9_4.3 +1
- Red Hat Enterprise Linux CRB (v. 9) python3.11-3.11.7-1.el9_4.3, python3.11-debug-3.11.7-1.el9_4.3, python3.11-idle-3.11.7-1.el9_4.3 +2
- RHSA-2024:4779 Released 2024-07-23 · Red Hat rating Lowpython3 security update
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.18-3.el9_4.3, python3-devel-3.9.18-3.el9_4.3, python3-tkinter-3.9.18-3.el9_4.3
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.18-3.el9_4.3, python3-libs-3.9.18-3.el9_4.3, python3.9-3.9.18-3.el9_4.3
- Red Hat Enterprise Linux CRB (v. 9) python3-3.9.18-3.el9_4.3, python3-debug-3.9.18-3.el9_4.3, python3-idle-3.9.18-3.el9_4.3 +2
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| RHOAI-2.13-RHEL-8 | Fixed | — |
| RHOAI-2.14-RHEL-8 | Fixed | — |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:9190 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:5962, RHSA-2024:6961, RHSA-2024:6962, RHSA-2024:6975 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:4766, RHSA-2024:4779, RHSA-2024:9190 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:6030 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:6975 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:4779 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:6030 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2024:7417 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:5962, RHSA-2024:6961, RHSA-2024:6962 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:4766, RHSA-2024:4779 |
Not affected: 2 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4032
- 2026-10-03 Alias added: GHSA-mh6q-v4mp-2cc7
- 2026-10-31 Fix available: RHOAI-2.13-RHEL-8, RHOAI-2.14-RHEL-8 · Red Hat
References
Patch 7
- https://github.com/python/cpython/pull/113179
- https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8
- https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f
- https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3
- https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb
- https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906
- https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3
Advisory 1
Other 5
- https://github.com/python/cpython/issues/113171
- https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
- https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
- http://www.openwall.com/lists/oss-security/2024/06/17/3
- https://security.netapp.com/advisory/ntap-20240726-0004/
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2024-4032 · CVE Program
- CVE-2024-4032 · NVD
- FIRST EPSS
- GHSA-mh6q-v4mp-2cc7 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4032 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences