CVE-2024-39780
Publication date 2 April 2025
Last updated 18 July 2025
Ubuntu priority
Description
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ros-dynamic-reconfigure | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| ros-kinetic-dynamic-reconfigure | 16.04 LTS xenial |
Fixed 1.5.50+3
|
| ros-melodic-dynamic-reconfigure | 18.04 LTS bionic |
Fixed 1.6.5+3
|
| ros-noetic-dynamic-reconfigure | 20.04 LTS focal |
Fixed 1.7.6+2
|
Notes
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |