CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

Perl YAML before 1.30 unsafely deserializes a document that uses a perl/hash:Class tag to bless a hash into a class named by the document. The document supplies the object's fields, and when the object later goes out of scope Perl calls that class's DESTROY method. What DESTROY does depends on classes already loaded in the process; with core File::Temp::Dir, the document can delete a directory tree it names. Any application that loads untrusted YAML with an affected YAML.pm is exposed to this object-injection behavior. No public proof-of-concept is known, the issue is not in CISA KEV, and in-the-wild exploitation has not been reported.

Do: Upgrade the Perl YAML distribution to 1.30 or later. Until then, do not load untrusted YAML with the affected module, and treat documents that contain perl/hash tags as hostile. After upgrading, confirm applications no longer deserialize external YAML into live Perl objects.