Skip to content
OpenAdvisories
Critical RHSA-2026:93471 2 CVEs

Red Hat Security Advisory: perl-YAML:1.24 security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-YAML 0:1.24-4.module+el8.10.0+25073+d1062575

Vulnerabilities 2

  • Critical 9.1
    CVE-2017-20285

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …

    libyaml-perl libyaml-perl Debian Ubuntu
  • High 7.3
    CVE-2019-25777

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…

    libyaml-perl libyaml-perl Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2545818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2545820
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93471.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-20285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-20285
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-20285
  • article
    https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch
  • article
    https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch
  • article
    https://github.com/ingydotnet/yaml-pm/issues/176
  • article
    https://metacpan.org/release/TINITA/YAML-1.30/changes
  • report
    https://access.redhat.com/security/cve/CVE-2019-25777
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-25777
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-25777
  • article
    https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch
  • article
    https://github.com/ingydotnet/yaml-pm/issues/212
  • article
    https://metacpan.org/release/TINITA/YAML-1.28/changes