CVE-2020-10289

RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132

State: Published
Severity: 8.0 High
Published: Aug 20, 2020
Updated: Sep 16, 2024
Reserved: Mar 10, 2020

Description

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.

Scores

CVSS	Score	Vector	Source
3.0	8.0 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	Alias

Weaknesses

CWE-20

Affected Products

Product	Versions
rosOpen Robotics	ROS Melodic Morenia and prior distrosAffected

References

https://github.com/ros/actionlib/pull/171

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.