CVE-2019-25777

A flaw was found in perl-yaml. This vulnerability can lead to arbitrary code execution because the parser fails to restrict package variable modifications specified in YAML documents. An attacker capable of submitting crafted YAML input can overwrite internal configuration settings to enable code loading, allowing them to execute arbitrary Perl code within the running process.

This vulnerability is rated as Important severity because successful exploitation allows an attacker to achieve arbitrary code execution within the context of the running Perl application, potentially compromising the host system. Although embedded code evaluation is disabled by default in Red Hat Enterprise Linux packages, an attacker supplying malicious serialized YAML data can bypass these safeguards by modifying package-level variables and runtime configurations in memory. Exploitation requires the target application to accept untrusted inputs and process them across multiple deserialization calls within a persistent execution context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.