Skip to content
OpenAdvisories
Unscored CVE-2019-13465 EUVD-2019-4936GHSA-4cwx-xrxh-9ff7

An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG on…

Published Dec 30, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG only works when ROS_ASSERT_ENABLED is defined. This leads to a problem in the remove() function in clients/roscpp/src/libros/spinner.cpp. When ROS_ASSERT_ENABLED is not defined, the iterator loop will run out of the scope of the array, and cause denial of service for other components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now believes it was a false alarm.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ros-ros-comm 1.14.3+ds1-10 —
Debian 13 ros-ros-comm 1.14.3+ds1-10 —
Debian 12 ros-ros-comm 1.14.3+ds1-10 —
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS ros-ros-comm No fix yet —
Ubuntu 16.04 LTS ros-ros-comm No fix yet —

References