CVE-2024-39780 Details

A YAML deserialization vulnerability exists in the Robot Operating System (ROS) 'dynparam' command-line tool, which is used to manage parameters of dynamically configurable nodes. This vulnerability affects ROS distributions Noetic and earlier. The issue arises from the 'dynparam' script processing unsanitized parameter input with the unsafe 'yaml.load()' function, allowing for the creation and execution of arbitrary Python objects. As a result, local or remote users can craft inputs that execute arbitrary Python code. This vulnerability has been patched in ROS Noetic by replacing 'yaml.load()' with 'yaml.safe_load()' and is available in the latest version of the 'dynamic_reconfigure' package.

Users can update to the latest version of the 'dynamic_reconfigure' package in ROS Noetic, where this vulnerability has been fixed. For ROS distributions after Noetic, the 'dynamic_reconfigure' package will need to be manually patched or the vulnerability addressed through other means.