PT-2024-23568 · Ros2 · Ros2

Published 2024-04-08 · Updated 2024-05-27 · CVE-2024-30687

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3

Description An insecure deserialization issue allows attackers to execute arbitrary code via a crafted input to the Data Serialization and Deserialization Components, Inter-Process Communication Mechanisms, and Network Communication Interfaces.

Recommendations For ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3, consider disabling the deserialization functionality in the Data Serialization and Deserialization Components until a patch is available. Restrict access to the Inter-Process Communication Mechanisms and Network Communication Interfaces to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-30687

Affected Products

Ros2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-30687 · Security Note
• https://t.me/cvenotify/76119 · Telegram Post
• https://twitter.com/CVEnew/status/1777565856945627519 · Twitter Post