Vulnerability Description
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openrobotics | Robot Operating System | indigo_igloo |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2024-39780?
CVE-2024-39780 is a vulnerability with a CVSS score of 7.8 (HIGH). A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, aff...
How severe is CVE-2024-39780?
CVE-2024-39780 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-39780?
Check the references section above for vendor advisories and patch information. Affected products include: Openrobotics Robot Operating System.