CVE-2020-16124 Integer overflow in ROS communications library
Unauthenticated network traffic can trigger an integer overflow in the ROS XML RPC library, potentially causing unexpected behavior or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-16124?
CVE-2020-16124 is a high-severity vulnerability in openrobotics ros_comm ROS communications packages, published on 13 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to cause unexpected behavior. This issue affects: OpenRobotics ros_comm communications packages Noetic and prior versions. Fixed in https://github.com/ros/ros_comm/pull/2065.
Weakness: CWE-190
Which versions are affected by CVE-2020-16124?
It affects 1 product.
Products include Ros Ros-Comm.
How do I fix CVE-2020-16124?
Apply the vendor's patch.
Is CVE-2020-16124 being exploited?
There is no known exploitation of CVE-2020-16124 in the wild and no public exploit code.
Other vulnerabilities in openrobotics ros_comm ROS communications packages
Sources
Also known as DEBIAN-CVE-2020-16124, GHSA-gvrq-7c4p-64rf, UBUNTU-CVE-2020-16124.