Source: ros-ros-comm Version: 1.17.0+ds-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for ros-ros-comm. I'm actually not really sure how we can tackle those or should handle them. There is as well only little additional information on those. Maybe remove all ROS1 related packages? CVE-2024-39289[0]: | A code execution vulnerability has been discovered in the Robot | Operating System (ROS) 'rosparam' tool, affecting ROS distributions | Noetic Ninjemys and earlier. The vulnerability stems from the use of | the eval() function to process unsanitized, user-supplied parameter | values via special converters for angle representations in radians. | This flaw allowed attackers to craft and execute arbitrary Python | code. CVE-2024-39835[1]: | A code injection vulnerability has been identified in the Robot | Operating System (ROS) 'roslaunch' command-line tool, affecting ROS | distributions Noetic Ninjemys and earlier. The vulnerability arises | from the use of the eval() method to process user-supplied, | unsanitized parameter values within the substitution args mechanism, | which roslaunch evaluates before launching a node. This flaw allows | attackers to craft and execute arbitrary Python code. CVE-2024-41148[2]: | A code injection vulnerability has been discovered in the Robot | Operating System (ROS) 'rostopic' command-line tool, affecting ROS | distributions Noetic Ninjemys and earlier. The vulnerability lies in | the 'hz' verb, which reports the publishing rate of a topic and | accepts a user-provided Python expression via the --filter option. | This input is passed directly to the eval() function without | sanitization, allowing a local user to craft and execute arbitrary | code. CVE-2024-41921[3]: | A code injection vulnerability has been discovered in the Robot | Operating System (ROS) 'rostopic' command-line tool, affecting ROS | distributions Noetic Ninjemys and earlier. The vulnerability lies in | the 'echo' verb, which allows a user to introspect a ROS topic and | accepts a user-provided Python expression via the --filter option. | This input is passed directly to the eval() function without | sanitization, allowing a local user to craft and execute arbitrary | code. CVE-2025-3753[4]: | A code execution vulnerability has been identified in the Robot | Operating System (ROS) 'rosbag' tool, affecting ROS distributions | Noetic Ninjemys and earlier. The vulnerability arises from the use | of the eval() function to process unsanitized, user-supplied input | in the 'rosbag filter' command. This flaw enables attackers to craft | and execute arbitrary Python code. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-39289 https://www.cve.org/CVERecord?id=CVE-2024-39289 [1] https://security-tracker.debian.org/tracker/CVE-2024-39835 https://www.cve.org/CVERecord?id=CVE-2024-39835 [2] https://security-tracker.debian.org/tracker/CVE-2024-41148 https://www.cve.org/CVERecord?id=CVE-2024-41148 [3] https://security-tracker.debian.org/tracker/CVE-2024-41921 https://www.cve.org/CVERecord?id=CVE-2024-41921 [4] https://security-tracker.debian.org/tracker/CVE-2025-3753 https://www.cve.org/CVERecord?id=CVE-2025-3753 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
