CVE-2020-10289 RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132
An unsafe YAML load in ROS actionlib allows attackers to execute arbitrary Python code via crafted action messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-10289?
CVE-2020-10289 is a high-severity unsafe deserialization vulnerability in Open Robotics ros, published on 20 Aug 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.
Which versions are affected by CVE-2020-10289?
It affects 1 product.
Products include Openrobotics Robot Operating System.
How do I fix CVE-2020-10289?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-10289 being exploited?
There is no known exploitation of CVE-2020-10289 in the wild and no public exploit code.
Other vulnerabilities in Open Robotics ros
Sources
Also known as DEBIAN-CVE-2020-10289, DLA-2357-1, GHSA-2x5j-2j53-xffv, UBUNTU-CVE-2020-10289.