Vulnerability Description
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openrobotics | Robot Operating System | - |
Related Weaknesses (CWE)
References
- https://github.com/ros/actionlib/pull/171PatchThird Party Advisory
- https://github.com/ros/actionlib/pull/171PatchThird Party Advisory
FAQ
What is CVE-2020-10289?
CVE-2020-10289 is a vulnerability with a CVSS score of 8.8 (HIGH). Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and ...
How severe is CVE-2020-10289?
CVE-2020-10289 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10289?
Check the references section above for vendor advisories and patch information. Affected products include: Openrobotics Robot Operating System.