YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.
CVE-2019-25777
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2019-25777
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/ingydotnet/yaml-pm",
"modules": [
"YAML"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.27_001",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/YAML",
"packageName": "YAML",
"programFiles": [
"lib/YAML/Types.pm"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "YAML::Type::glob::yaml_load"
}
]
}
]- Related CVEs
- CVE-2019-25777
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #9403 · Revision 1
- Added to Heist Feed
- Publisher date