Unsafe deserialization in Perl YAML before 1.30
Perl YAML before 1.30 unsafely deserializes a document that uses a perl/hash:Class tag to bless a hash into a class named by the document. The document supplies the object's fields, and when the object later goes out of scope Perl calls that class's DESTROY method. What DESTROY does depends on classes already loaded in the process; with core File::Temp::Dir, the document can delete a directory tree it names. Any application that loads untrusted YAML with an affected YAML.pm is exposed to this object-injection behavior. No public proof-of-concept is known, the issue is not in CISA KEV, and in-the-wild exploitation has not been reported.
What to do: Upgrade the Perl YAML distribution to 1.30 or later. Until then, do not load untrusted YAML with the affected module, and treat documents that contain perl/hash tags as hostile. After upgrading, confirm applications no longer deserialize external YAML into live Perl objects.
| Ingy döt Net YAML | before 1.30 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
Perl YAML before 1.30 lets a loaded document invoke DESTROY on arbitrary classes.
Stig Palmquist reported CVE-2017-20285 in the Perl YAML module, tracked on CPAN and GitHub as yaml-pm. Versions before 1.30 let a loaded YAML document trigger the DESTROY method of arbitrary classes. The notice does not say the flaw is being exploited.
Ubuntu patched YAML-LibYAML flaws that could delete files or run code on 16.04 and 18.04 LTS.
Ubuntu security notice USN-8925-1 covers YAML-LibYAML flaws. CVE-2017-20285, discovered by Dominique Dumont, involves unsafe reflection handling that could delete files if a crafted file is opened, and affects only Ubuntu 16.04 LTS and 18.04 LTS. CVE-2019-25777 is a parsing flaw that could allow arbitrary code execution under the same conditions and on the same releases. The excerpt also begins describing a regular-expression issue but does not name another CVE.