CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
Perl YAML before 1.30 lets a loaded document invoke DESTROY on arbitrary classes.
Stig Palmquist reported CVE-2017-20285 in the Perl YAML module, tracked on CPAN and GitHub as yaml-pm. Versions before 1.30 let a loaded YAML document trigger the DESTROY method of arbitrary classes. The notice does not say the flaw is being exploited.
36