CriticalFix available

libyaml-perl — security advisory

Type: advisorySources: OSVAdvisory ID: DEBIAN-CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Products: libyaml-perl
Affected versions: Not specified
Fixed versions: 1.30-1
CVEs: CVE-2017-20285
Confirmed fixed CVEs: Not specified
Updated in this feed: 28 Oct 2026, 03:41 UTC · Revision 1

Source evidence

DEBIAN-CVE-2017-20285

core-osv · Original source

Published 5 Oct 2026, 07:16 UTC

osv:DEBIAN-CVE-2017-20285

libyaml-perl

Fixed versions: 1.30-1

libyaml-perl

Fixed versions: 1.30-1

libyaml-perl

Fixed versions: 1.30-1

Complete source record

{
  "id": "eab412e176aee087cf9b28ed8e5fd8898dc592588d33591431ff21004c1d1288",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2017-20285",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2017-20285",
    "summary": "YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.",
    "evidence": "osv:DEBIAN-CVE-2017-20285",
    "products": [
      {
        "name": {
          "value": "libyaml-perl",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.30-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "libyaml-perl",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.30-1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "libyaml-perl",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.30-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "DEBIAN-CVE-2017-20285",
      "aliases": [
        "DEBIAN-CVE-2017-20285"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.30-1"
                }
              ]
            }
          ],
          "package": {
            "name": "libyaml-perl",
            "purl": "pkg:deb/debian/libyaml-perl?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-20285.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.30-1"
                }
              ]
            }
          ],
          "package": {
            "name": "libyaml-perl",
            "purl": "pkg:deb/debian/libyaml-perl?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-20285.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.30-1"
                }
              ]
            }
          ],
          "package": {
            "name": "libyaml-perl",
            "purl": "pkg:deb/debian/libyaml-perl?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-20285.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-07T10:00:04.144896584Z",
      "provider": "osv",
      "upstream": [
        "CVE-2017-20285"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2017-20285"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2017-20285",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 94686,
  "published_at": "2026-10-05T07:16:29.017+00:00"
}