Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.A perl/hash:Class tag blesses a hash into the class it names.
Back to all
CVE

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.A perl/hash:Class tag blesses a hash into the class it names.

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.

A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.

What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
-

Related Resources

No items found.

References

http://www.openwall.com/lists/oss-security/2026/10/05/8, https://metacpan.org/release/TINITA/YAML-1.30/changes, https://github.com/ingydotnet/yaml-pm/issues/176, https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch, https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch

Severity

9.1

CVSS Score
0
10

Basic Information

Base CVSS
9.1
EPSS Probability
0.0034%
EPSS Percentile
0.27552%
Introduced Version
0
Fix Available
7736f38bd02e4f9f77d5468721e3be3d7b34a8ec,0:1.24-4.module+el8.10.0+25073+42d87e53,1.30-1,1.24-1ubuntu0.1~esm1,0:0.84-5.amzn2.0.2

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading