CVE-2024-4032 Overview
The Python ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as "globally reachable" or "private". This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn't be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.
CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
Critical Impact
Applications relying on the ipaddress module for network access control decisions may incorrectly classify IP addresses, potentially allowing unauthorized network access or leaking sensitive information to unintended destinations.
Affected Products
- CPython versions prior to 3.12.4
- CPython versions prior to 3.13.0a6
- Any Python application using the ipaddress module for IP classification
Discovery Timeline
- 2024-06-17 - CVE-2024-4032 published to NVD
- 2025-11-03 - Last updated in NVD database
Technical Details for CVE-2024-4032
Vulnerability Analysis
This vulnerability falls under CWE-697 (Incorrect Comparison), where the ipaddress module's internal data structures contained outdated IANA registry information. Applications that use is_private or is_global properties to make security decisions—such as blocking connections to private networks or restricting data transmission to certain address ranges—could be making incorrect determinations.
The core issue lies in the module's hardcoded address range classifications not reflecting the latest IANA Special-Purpose Address Registries. When IP addresses are evaluated using these properties, the returned boolean values may not accurately represent whether an address is truly private or globally reachable according to current IANA standards.
Root Cause
The root cause is the use of outdated IANA registry data within the Python ipaddress module. The IANA Special-Purpose Address Registries (for both IPv4 and IPv6) are periodically updated to reflect new address allocations and designations. The Python module had not been updated to match these registry changes, causing classification discrepancies.
Attack Vector
The vulnerability is exploitable over the network. An attacker could exploit applications that rely on the ipaddress module for security-critical decisions. For example:
- An application using is_private to block connections to internal networks might incorrectly allow connections to addresses that should be classified as private
- A service restricting data exports to "global" addresses might inadvertently send sensitive data to addresses incorrectly classified as globally reachable
- Network filtering or firewall bypass could occur if classification decisions are made using the flawed module
The vulnerability mechanism involves the is_private and is_global properties returning incorrect boolean values. When an application calls these properties on an IP address object, the module checks the address against internal range definitions. With outdated registry data, certain address ranges would return incorrect classification results, potentially undermining access control logic.
For detailed technical information, see the GitHub Issue Discussion and the Python Security Announcement.
Detection Methods for CVE-2024-4032
Indicators of Compromise
- Unexpected network connections being allowed or blocked by applications using Python's ipaddress module
- Audit logs showing IP address classifications that don't match expected IANA registry definitions
- Security controls bypassed for specific IP address ranges that should be restricted
Detection Strategies
- Review application code for usage of ipaddress.IPv4Address.is_private, ipaddress.IPv4Address.is_global, ipaddress.IPv6Address.is_private, and ipaddress.IPv6Address.is_global properties
- Audit network access control decisions that rely on Python's ipaddress module classification
- Compare IP classification results against current IANA registry data to identify discrepancies
- Scan Python environments to identify versions prior to 3.12.4 or 3.13.0a6
Monitoring Recommendations
- Implement logging for all IP classification decisions made by applications using the ipaddress module
- Monitor for anomalous network traffic patterns that could indicate misclassified addresses
- Set up alerts for connections to or from IP addresses in IANA special-purpose ranges
- Track Python version deployments across infrastructure to ensure patched versions are in use
How to Mitigate CVE-2024-4032
Immediate Actions Required
- Upgrade CPython to version 3.12.4 or 3.13.0a6 or later immediately
- Audit all applications using the ipaddress module for security-critical IP classification decisions
- Implement additional validation layers for IP address classification beyond the ipaddress module
- Review network access control policies that may have been impacted by incorrect classifications
Patch Information
The vulnerability has been addressed in CPython versions 3.12.4 and 3.13.0a6, which contain updated IANA registry information. Multiple commits were applied to fix this issue across different Python branches:
Additional vendor advisories are available from NetApp and Debian LTS.
Workarounds
- Implement custom IP classification logic that directly references current IANA registry data rather than relying solely on the ipaddress module
- Add secondary validation using external IP classification services or libraries with up-to-date registry information
- Apply network-level access controls as an additional layer of defense, independent of application-level IP classification
- For critical applications, maintain a manually-updated allowlist/blocklist of known special-purpose address ranges
# Verify Python version and upgrade if necessary
python3 --version
# If version is below 3.12.4, upgrade using your package manager
# Example for systems using pyenv
pyenv install 3.12.4
pyenv global 3.12.4
# Example for Debian/Ubuntu systems
sudo apt update && sudo apt install python3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
