CVE catalog

CVE-2024-39780

ros-dynamic-reconfigure: CVE-2024-39780

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianros-dynamic-reconfiguresid1.7.6-1fixed
Debianros-dynamic-reconfigureforky1.7.6-1fixed
Debianros-dynamic-reconfiguretrixie1.7.3-2vulnerable
Debianros-dynamic-reconfigurebookworm1.7.3-1vulnerable
Ubunturos-dynamic-reconfigure16.041.5.39-1vulnerable
Ubunturos-dynamic-reconfigure16.041.5.39-2vulnerable
Ubunturos-dynamic-reconfigure18.041.5.46-1vulnerable
Ubunturos-dynamic-reconfigure18.041.5.46-1build1vulnerable
Ubunturos-dynamic-reconfigure18.041.5.49-1vulnerable
Ubunturos-dynamic-reconfigure20.041.6.0-1build1vulnerable
Ubunturos-dynamic-reconfigure20.041.6.0-3vulnerable
Ubunturos-dynamic-reconfigure20.041.6.0-3ubuntu1vulnerable
Ubunturos-dynamic-reconfigure22.041.7.1-3vulnerable
Ubunturos-dynamic-reconfigure22.041.7.1-11vulnerable
Ubunturos-dynamic-reconfigure22.041.7.2-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianros-dynamic-reconfiguresourcesid1.7.6-1not yet assignedNot reported[1102010]
Debianros-dynamic-reconfiguresourceforky1.7.6-1not yet assignedNot reported[1102010]
Debianros-dynamic-reconfiguresourcetrixie(unfixed)not yet assignedNot reported[1102010]
Debianros-dynamic-reconfiguresourcebookworm(unfixed)not yet assignedNot reported[1102010]

[Debian bug #1102010]

Notes

[trixie] ros-dynamic-reconfigure: Minor issue [bookworm] ros-dynamic-reconfigure: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cl-dynamic-reconfigure]Affected

    Source package: [ros-dynamic-reconfigure]

    Details (2)

    • 1.7.3-1 · all · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

    • 1.7.3-1 · all · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

  • [libdynamic-reconfigure-config-init-mutex0d]Affected

    Source package: [ros-dynamic-reconfigure]

    Details (2)

    • 1.7.3-1 · amd64 · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

    • 1.7.3-1 · arm64 · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

  • [libdynamic-reconfigure-config-init-mutex-dev]Affected

    Source package: [ros-dynamic-reconfigure]

    Details (2)

    • 1.7.3-1 · amd64 · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

    • 1.7.3-1 · arm64 · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

  • [python3-dynamic-reconfigure]Affected

    Source package: [ros-dynamic-reconfigure]

    Details (2)

    • 1.7.3-1 · all · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

    • 1.7.3-1 · all · bookworm

      Affected

      dsa · ros-dynamic-reconfigure · debian · bookworm; dsa · ros-dynamic-reconfigure · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]