CVE-2024-4032

Published: 17 June 2024

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

Notes

Author	Note
	Priority reason: This is a low severity issue that only mis-classes certain ip addresses

Priority

Status

Package	Release	Status
python2.7 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
	focal	Not vulnerable (code not present)
	jammy	Not vulnerable (code not present)
	mantic	Does not exist
	noble	Does not exist
	trusty	Not vulnerable (code not present)
	upstream	Not vulnerable (code not present)
	xenial	Not vulnerable (code not present)
python3.10 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Released (3.10.12-1~22.04.5)
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906
python3.11 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Needs triage
	mantic	Ignored (end of life, was needs-triage)
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb
python3.12 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Ignored (end of life, was needs-triage)
	noble	Released (3.12.3-1ubuntu0.1)
	upstream	Released (3.12.4-1)
	Patches: upstream: https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3
python3.4 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Needs triage
	upstream	Needs triage
python3.5 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Needs triage
	upstream	Needs triage
	xenial	Needs triage
python3.6 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
python3.7 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
python3.8 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Released (3.8.10-0ubuntu1~20.04.11)
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3
python3.9 Launchpad, Ubuntu, Debian	focal	Needs triage
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8

References

Bugs

https://github.com/python/cpython/issues/113171

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›