Read the docs
TI-2017-14763 Aliases CVE-2017-20285GHSA-c454-fc94-q86x

Perl YAML deserialization runs DESTROY on arbitrary classes

Priority MEDIUM 47CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-502.

Summary

YAML for Perl versions before 1.30 mishandles documents that use the perl/hash:Class tag, which blesses a hash into a class the document names (CWE-502). An unauthenticated remote attacker who gets a crafted document loaded can make Perl call the DESTROY method of arbitrary loaded classes. With File::Temp::Dir from core Perl, this can delete a directory tree the document names.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Partial YAML: 1.30Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—YAMLbefore 1.301.30Patch availableCNA
  • YAML Vendor— Affected before 1.30 Fixed in 1.30 Patch available CNA

Remediation

Upgrade YAML for Perl to version 1.30 or later. Red Hat fixes perl-YAML:1.24 for Red Hat Enterprise Linux AppStream (v. 8) in RHSA-2026:93471. Red Hat lists Red Hat Enterprise Linux 7 as affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA YAML Fixed in 1.30

Red Hat 1 advisory

  • RHSA-2026:93471 Released 2026-11-02 · Red Hat rating Important
    perl-YAML:1.24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.noarch::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.src::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+d1062575.noarch::perl-YAML:1.24 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:93471
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-05 Threatist record created from CVE-2017-20285
  2. 2026-10-05 Alias added: GHSA-c454-fc94-q86x
  3. 2026-10-05 Affected versions changed · Red Hat
  4. 2026-10-05 CVSS score added · Red Hat
  5. 2026-10-06 Affected versions changed · Red Hat
  6. 2026-10-06 CVSS score added · CISA ADP
  7. 2026-10-06 CISA SSVC decision points changed
  8. 2026-10-06 Priority changed: LOW → MEDIUM
  9. 2026-10-21 Affected versions changed · Red Hat
  10. 2026-11-02 Fix available: RHSA-2026:93471 · Red Hat
  11. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat

References

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences