CVE-2017-20285

A flaw was found in perl-yaml. An attacker can trigger unintended actions, such as arbitrary file deletion, by supplying a specially crafted YAML document. The parser permits untrusted documents to instantiate arbitrary object classes, causing Perl to automatically execute their destructor methods when the objects are cleaned up.

This vulnerability is rated as Important severity because parsing untrusted YAML input enables unprivileged attackers to trigger arbitrary object destructors, potentially resulting in high integrity and availability damage such as unintended filesystem deletion. Within Red Hat Enterprise Linux, the blast radius is determined by whether services or scripts accept unvalidated YAML data from external sources. While exploitation requires compatible Perl modules to be loaded in the process context, it poses a direct risk to applications processing user-supplied documents.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.