CVE-2024-4032

What it actually does

The ipaddress module returns incorrect boolean values for is_private and is_global on IPv4Address, IPv4Network, IPv6Address, and IPv6Network objects because its internal registry data does not match the current IANA Special-Purpose Address Registries.

Why it matters to the business

Applications that rely on these properties for access-control, logging, or routing decisions may permit traffic from addresses that should be treated as private or block addresses that should be treated as global, creating operational friction and potential exposure of internal resources.

How an attack unfolds

An attacker supplies an IPv4 or IPv6 address whose registry status changed after the module's data was frozen; the flawed is_private or is_global result is then used by the target application to decide whether to accept, forward, or log the address, allowing the attacker to reach a resource that the application intended to restrict.

How to fix it

Upgrade CPython to a build containing commit 22adf29da8d99933ffed8647d3e0726edd16f7f8 (equivalent to 3.12.4 or 3.13.0a6). Rebuild and redeploy any statically linked or vendored copies of the ipaddress module. Re-test all code paths that consume is_private or is_global after the upgrade.

How to confirm the fix worked

Run the Python regression tests for the ipaddress module or execute a small script that instantiates the four affected classes with addresses whose status changed in the IANA registries and assert that is_private and is_global now return the expected values. Confirm the interpreter reports a version at or above the fixed releases.

Typical attack path

1. Identify an application that imports ipaddress and uses is_private or is_global to gate network decisions
2. Select an address whose IANA designation changed since the module's data snapshot
3. Send the address (or cause it to be processed) through the application's input path
4. Observe the application applying the incorrect classification and granting or denying access accordingly

How to detect it

Search application logs and source code for imports of ipaddress combined with calls to is_private or is_global; correlate any anomalous allow/deny decisions involving IPv4 or IPv6 addresses that match known registry changes. No runtime exploit artifacts are produced by the library itself.

What your security team should do

• Prioritize upgrade of any internet-facing services or internal tools that use ipaddress for filtering decisions within the next sprint
• Add the fixed commit hash or minimum Python version to dependency manifests and CI pipelines
• Review application logic that trusts is_private or is_global and add compensating controls (e.g., explicit allow-lists) until the library is updated
• Monitor EPSS and KEV feeds; schedule re-assessment if either metric rises