ALAS2023-2025-1036 — Moderate: perl-YAML-LibYAML security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2023	perl-YAML-LibYAML	1:0.82-4.amzn2023.0.3
Amazon Linux · 2023	perl-YAML-LibYAML-debuginfo	1:0.82-4.amzn2023.0.3
Amazon Linux · 2023	perl-YAML-LibYAML-debugsource	1:0.82-4.amzn2023.0.3

Vulnerabilities 1

Critical 9.1

CVE-2025-40908

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

TINITA YAML::LibYAML libyaml-libyaml-perl libyaml-libyaml-perl Debian Ubuntu Azure Linux

Jun 1, 2025

References

web
https://alas.aws.amazon.com/cve/html/CVE-2025-40908.html