CVE-2024-4032 — Incorrect Comparison in Software Foundation Cpython

CWE-697 — Incorrect ComparisonCWE-440 — Expected Behavior Violation14 documents8 sources
Severity
7.5HIGHNVD
OSV6.3
EPSS
1.1%
top 21.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Python Software Foundation Cpython
Timeline
PublishedJun 17
Latest updateMar 24

Description

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated informati…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5python_software_foundation/cpython3.9.0 — 3.9.20+5

🔴Vulnerability Details

7
OSV
python3.5, python3.8 regression↗2025-03-24
▶
OSV
python3.5, python3.8 vulnerabilities↗2025-03-12
▶
OSV
python3.10, python3.8 vulnerabilities↗2024-07-30
▶
GHSA
GHSA-mh6q-v4mp-2cc7: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “priva↗2024-06-17
▶
OSV
CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “priva↗2024-06-17
▶

📋Vendor Advisories

6
Ubuntu
Python vulnerabilities↗2025-03-12
▶
Ubuntu
Python vulnerability↗2024-08-01
▶
Ubuntu
Python vulnerabilities↗2024-07-30
▶
Red Hat
python: incorrect IPv4 and IPv6 private ranges↗2024-06-17
▶
Microsoft
Incorrect IPv4 and IPv6 private ranges↗2024-06-11
▶
CVE-2024-4032 — Incorrect Comparison | cvebase