Python3.4: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or… (CVE-2024-4032)
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
AI Analysis
Technical Summary
Red Hat issued security updates for Python 3.9 and python39-devel modules to address several vulnerabilities. CVE-2024-4032 involves incorrect IPv4 and IPv6 private range handling in Python, potentially affecting network-related functionality. CVE-2024-6345 is a remote code execution vulnerability in the pypa/setuptools package_index module's download functions. CVE-2024-6923 concerns improper quoting of newlines in email headers within the Python email module, allowing header injection. CVE-2024-8088 is an additional vulnerability collected from NVD affecting CPython. These vulnerabilities affect multiple Red Hat Enterprise Linux 8 and 9 variants and related builder modules. Red Hat has released updated packages to remediate these issues, with detailed instructions available in their advisories.
Potential Impact
The vulnerabilities collectively pose a moderate security risk. Incorrect private IP range handling could lead to improper network behavior or security policy bypasses. Remote code execution in setuptools could allow attackers to execute arbitrary code during package installation or download. Email header injection could facilitate injection attacks via crafted email headers. The overall impact is mitigated by the availability of patches and updates from Red Hat. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates for the affected Python 3.9 packages and related modules in Red Hat Enterprise Linux 8 and 9. Users should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. The advisory indicates that the issues are fixed in the updated packages. No additional mitigations beyond applying the official patches are required.
Python3.4: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or… (CVE-2024-4032)
Description
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued security updates for Python 3.9 and python39-devel modules to address several vulnerabilities. CVE-2024-4032 involves incorrect IPv4 and IPv6 private range handling in Python, potentially affecting network-related functionality. CVE-2024-6345 is a remote code execution vulnerability in the pypa/setuptools package_index module's download functions. CVE-2024-6923 concerns improper quoting of newlines in email headers within the Python email module, allowing header injection. CVE-2024-8088 is an additional vulnerability collected from NVD affecting CPython. These vulnerabilities affect multiple Red Hat Enterprise Linux 8 and 9 variants and related builder modules. Red Hat has released updated packages to remediate these issues, with detailed instructions available in their advisories.
Potential Impact
The vulnerabilities collectively pose a moderate security risk. Incorrect private IP range handling could lead to improper network behavior or security policy bypasses. Remote code execution in setuptools could allow attackers to execute arbitrary code during package installation or download. Email header injection could facilitate injection attacks via crafted email headers. The overall impact is mitigated by the availability of patches and updates from Red Hat. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates for the affected Python 3.9 packages and related modules in Red Hat Enterprise Linux 8 and 9. Users should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. The advisory indicates that the issues are fixed in the updated packages. No additional mitigations beyond applying the official patches are required.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:5962
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-6345","CVE-2024-6923","CVE-2024-8088"]
Threat ID: 6a1f4e82e29bf47b5007cc8e
Added to database: 06/02/2026, 21:43:30 UTC
Last enriched: 08/15/2026, 18:03:50 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.