CVE-2017-20285
Publication date 5 October 2026
Last updated 14 October 2026
Ubuntu priority
Description
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libyaml-perl | 26.04 LTS resolute |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Fixed 1.24-1ubuntu0.1~esm1
|
|
| 16.04 LTS xenial |
Fixed 1.15-1ubuntu0.1~esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
rodrigo-zaiden
in affected releases, the dangerous bless is present and unguarded. upstream commit 471314bb adds $YAML::LoadBlessed feature to wrap and guard it, but defaults to ON. so commit 7736f38b sets the default to OFF completing the fix.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.1 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8925-1
- YAML-LibYAML vulnerabilities
- 14 October 2026