Vulnerability · Published Oct 13, 2020 · Assigned by canonical

CVE-2020-16124Integer overflow in ROS communications library

High 7.3

In plain English

A high-severity integer overflow in ros_comm ROS communications packages from openrobotics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.9%top 39.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to cause unexpected behavior. This issue affects: OpenRobotics ros_comm communications packages Noetic and prior versions. Fixed in https://github.com/ros/ros_comm/pull/2065.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ros-ros-comm	1.15.8+ds1-2	DEBIAN-CVE-2020-16124
Debian:13	ros-ros-comm	1.15.8+ds1-2	DEBIAN-CVE-2020-16124
Debian:14	ros-ros-comm	1.15.8+ds1-2	DEBIAN-CVE-2020-16124
Ubuntu:22.04:LTS	ros-ros-comm	no fix listed	UBUNTU-CVE-2020-16124

Affected products (as reported)

Vendor	Product	Versions
openrobotics	ros_comm ROS communications packages	Noetic – through Noetic

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/ros/ros_comm/pull/2065 x_refsource_CONFIRM