Summary
he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain't Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, data exchange, and human-readable data storage in Perl applications.
Security Fix(es):
* perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment (CVE-2019-25777)
* perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document (CVE-2017-20285)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | perl-YAML | 1.24-4.module_el8.10.0+4341+ab0ec422 |
Vulnerabilities 2
-
Critical 9.1
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …
-
High 7.3
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…