Vulnerability · Published Apr 2, 2025 · Assigned by canonical
CVE-2024-39780Use of unsafe yaml load in dynparam
High 7.8
In plain English
A high-severity unsafe deserialization in Robot Operating System (ROS) from Open Source Robotics Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ros-dynamic-reconfigure | no fix listed | DEBIAN-CVE-2024-39780 |
| Debian:13 | ros-dynamic-reconfigure | no fix listed | DEBIAN-CVE-2024-39780 |
| Debian:14 | ros-dynamic-reconfigure | 1.7.6-1 | DEBIAN-CVE-2024-39780 |
| Ubuntu:22.04:LTS | ros-dynamic-reconfigure | no fix listed | UBUNTU-CVE-2024-39780 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Source Robotics Foundation | Robot Operating System (ROS) | Noetic NinjemysMelodic MoreniaKinetic KameIndigo Igloo |
Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H