PT-2024-22908 · Ros2 · Ros2
CVE-2024-29452
·
Published
2024-04-10
·
Updated
2024-05-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
ROS2 Humble Hawksbill versions 2 and 3
Description
An insecure deserialization vulnerability has been identified, allowing attackers to execute arbitrary code and obtain sensitive information via crafted input to the Data Serialization and Deserialization Components, Inter-Process Communication Mechanisms, and Network Communication Interfaces.
Recommendations
For ROS2 Humble Hawksbill versions 2 and 3, consider disabling the deserialization functionality in the Data Serialization and Deserialization Components as a temporary workaround until a patch is available.
Restrict access to the Inter-Process Communication Mechanisms and Network Communication Interfaces to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ros2