CVE-2024-39780: Use of unsafe yaml load in dynparam

Published Apr 2, 2025

Updated

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Affected Software

5 affected components

Open Source Robotics Foundation Robot Operating System>Noetic

Openrobotics Robot Operating System=indigo_igloo

Openrobotics Robot Operating System=kinetic_kame

Openrobotics Robot Operating System=melodic_morenia

Openrobotics Robot Operating System=noetic_ninjemys

Remediation

Patch Available

https://github.com/ros/dynamic_reconfigure/pull/202

Event History

Apr 2, 2025

CVE Published

via MITRE·07:31 AM

Data Sourced

via MITRE·07:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39780?

CVE-2024-39780 is generally classified as a high-severity vulnerability due to its potential for arbitrary code execution.

How do I fix CVE-2024-39780?

To fix CVE-2024-39780, update to a patched version of the Robot Operating System (ROS) beyond Noetic.

Which ROS distributions are affected by CVE-2024-39780?

CVE-2024-39780 affects the Robot Operating System (ROS) Noetic and earlier versions.

What type of vulnerability is CVE-2024-39780?

CVE-2024-39780 is a YAML deserialization vulnerability in the ROS 'dynparam' tool.

How does CVE-2024-39780 impact software security?

CVE-2024-39780 can be exploited to execute arbitrary code, compromising the security of affected systems.