PT-2020-22802 · Perl · Perl-Yaml
Published
2020-07-05
·
Updated
2020-07-05
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
perl-YAML versions prior to 1.30
Description
The issue arises from the ability to evaluate typeglobs, which could allow setting the variable
$YAML::LoadCode from a YAML file, posing a security risk. This is mitigated by enforcing that $LoadCode must be enabled to use the typeglob feature.Recommendations
For versions prior to 1.30, update the perl-YAML package to version 1.30 to fix this issue and other bugs.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Perl-Yaml