search

ros / geometry

Packages for common geometric calculations including the ROS transform library, "tf". Also includes ROS bindings for "bullet" physics engine and "kdl" kinematics/dynamics package.
172 stars 274 forks source link

Unsafe call to yaml.load #197

Open vmatare opened 4 years ago

vmatare commented 4 years ago

https://github.com/ros/geometry/blob/00a32d024af476bf50822e6df2fe2ec97765b1a9/tf/src/tf/listener.py#L97

yaml.load is deprecated, and this call should be replaced with e.g. yaml.safe_load

See https://nvd.nist.gov/vuln/detail/CVE-2017-18342 Cf. https://github.com/ros/ros_comm/commit/29053c4832229efa7160fb944c05e3bc82e11540