[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b5876539-f429-4fd9-9efb-4da4b1c72d24@oracle.com>
Date: Mon, 17 Jun 2024 09:32:12 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: [Security-announce][CVE-2024-4032] Incorrect IPv4 and IPv6
private ranges
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2024-4032] Incorrect IPv4 and IPv6 private ranges
Date: Mon, 17 Jun 2024 09:01:18 -0500
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the 'is_private' and 'is_global' properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.
CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
Severity: Medium
References
* https://github.com/python/cpython/issues/113171
* https://github.com/python/cpython/pull/113179
* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
* https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
View attachment "Attached Message Part" of type "text/plain" (292 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
