Description: "Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug."
Please apply the linked patches if appropriate, if not we will wait.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e823bbf28f1e0d4698e1ac780365b22eefd2b6cb commit e823bbf28f1e0d4698e1ac780365b22eefd2b6cb Author: Alexis Ballier <aballier@gentoo.org> AuthorDate: 2020-08-24 15:17:39 +0000 Commit: Alexis Ballier <aballier@gentoo.org> CommitDate: 2020-08-25 12:37:22 +0000 dev-ros/actionlib_tools: bump to 1.13.2 Bug: https://bugs.gentoo.org/738168 Package-Manager: Portage-3.0.3, Repoman-3.0.0 Signed-off-by: Alexis Ballier <aballier@gentoo.org> dev-ros/actionlib_tools/Manifest | 2 +- .../{actionlib_tools-1.13.1.ebuild => actionlib_tools-1.13.2.ebuild} | 0 2 files changed, 1 insertion(+), 1 deletion(-)
Linked patches are in 1.13.2. Tree is clean, no stable versions, all done.
