Skip to content
OpenAdvisories
High ELSA-2026-93471 2 CVEs

Important: perl-YAML:1.24 security update (Oracle Linux 8)

Published Nov 4, 2026 · Updated Nov 4, 2026

Ecosystem: Oracle Linux

Summary

perl-YAML
[1.24-4]
- CVE-2017-20285 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary destructor
method execution via crafted YAML document destructor method execution via
crafted YAML document
- CVE-2019-25777 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary code
execution via unrestricted package variable assignment

[1.24-3]
- Rebuild with enable hardening (bug #1636329)

[1.24-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.24-1]
- Update to 1.24
- Fix (GH#180, GH#181, GH#182)
- This release by TINITA -> update source URL
- Drop redundant Group: tag

[1.23-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.23-3]
- Perl 5.26 re-rebuild of bootstrapped packages

[1.23-2]
- Perl 5.26 rebuild

[1.23-1]
- Update to 1.23
- Fix ::Numify (empty values were converted to 0)

[1.22-1]
- Update to 1.22
- Add ::Numify

[1.21-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

perl-YAML
[1.24-4]
- CVE-2017-20285 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary destructor
method execution via crafted YAML document destructor method execution via
crafted YAML document
- CVE-2019-25777 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary code
execution via unrestricted package variable assignment

[1.24-3]
- Rebuild with enable hardening (bug #1636329)

[1.24-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.24-1]
- Update to 1.24
- Fix (GH#180, GH#181, GH#182)
- This release by TINITA -> update source URL
- Drop redundant Group: tag

[1.23-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.23-3]
- Perl 5.26 re-rebuild of bootstrapped packages

[1.23-2]
- Perl 5.26 rebuild

[1.23-1]
- Update to 1.23
- Fix ::Numify (empty values were converted to 0)

[1.22-1]
- Update to 1.22
- Add ::Numify

[1.21-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 perl-YAML 0:1.24-4.module+el8.10.0+91104+33aeb071

Vulnerabilities 2

  • Critical 9.1
    CVE-2017-20285

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …

    libyaml-perl libyaml-perl Debian Ubuntu
  • High 7.3
    CVE-2019-25777

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…

    libyaml-perl libyaml-perl Debian Ubuntu