- Description
- A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
- Source
- security@ubuntu.com
- NVD status
- Analyzed
- Products
- robot_operating_system
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- security@ubuntu.com
- CWE-20
- Hype score
- Not currently trending
CVE-2024-39780 (CVSS:8.4, HIGH) is Awaiting Analysis. A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for g..https://t.co/CWZGu4y4UV #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
@cracbot
7 Apr 2025
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Critical vulnerability (CVE-2024-39780) found in ROS dynparam tool allowing code execution via unsafe YAML deserialization. Patch now if using ROS Noetic or earlier. High CVSS 8.4 score. Details: https://t.co/Hq7vSG3Gyy
@RedTeamNewsBlog
2 Apr 2025
1 Impression
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:openrobotics:robot_operating_system:indigo_igloo:*:*:*:*:*:*:*",
"matchCriteriaId": "0673568E-BE13-4D10-9E7B-57B6D38850B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:openrobotics:robot_operating_system:kinetic_kame:*:*:*:*:*:*:*",
"matchCriteriaId": "429E39E2-7812-44F3-B3DB-D82561432B88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:openrobotics:robot_operating_system:melodic_morenia:*:*:*:*:*:*:*",
"matchCriteriaId": "C319FA37-A18B-4706-9B29-827BA81CB5B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:openrobotics:robot_operating_system:noetic_ninjemys:*:*:*:*:*:*:*",
"matchCriteriaId": "2F466D1C-796D-4857-BEDF-FA600DF47669",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]