USN-8925-1: YAML-LibYAML vulnerabilities
Ubuntu patched YAML-LibYAML flaws that could delete files or run code on 16.04 and 18.04 LTS.
Ubuntu security notice USN-8925-1 covers YAML-LibYAML flaws. CVE-2017-20285, discovered by Dominique Dumont, involves unsafe reflection handling that could delete files if a crafted file is opened, and affects only Ubuntu 16.04 LTS and 18.04 LTS. CVE-2019-25777 is a parsing flaw that could allow arbitrary code execution under the same conditions and on the same releases. The excerpt also begins describing a regular-expression issue but does not name another CVE.
- CVE-2017-20285 could delete files via crafted YAML on Ubuntu 16.04 and 18.04.
- CVE-2019-25777 could allow code execution if a crafted document is parsed.
- Both named issues are limited to those older Ubuntu LTS releases.
Vulnerabilities mentionedAll →
- CVE-2017-202859.1—Unsafe deserialization in Perl YAML before 1.30published · Ingy döt Net YAML+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2017-20285+1 related CVE | Unsafe deserialization in Perl YAML before 1.30 Perl YAML before 1.30 unsafely deserializes a document that uses a perl/hash:Class tag to bless a hash into a class named by the document. The document supplies the object's fields, and when the object later goes out of scope Perl calls that class's DESTROY method. What DESTROY does depends on classes already loaded in the process; with core File::Temp::Dir, the document can delete a directory tree it names. Any application that loads untrusted YAML with an affected YAML.pm is exposed to this object-injection behavior. No public proof-of-concept is known, the issue is not in CISA KEV, and in-the-wild exploitation has not been reported. |
Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777) It was discovered that YAML-LibYAML contained a regular…
This source does not provide full text. Read it at ubuntu.com.