Perl-YAML:1.24 Security Update — AlmaLinux 8 (ALSA-2026:93471)

ALSA-2026:93471 updates perl-YAML on AlmaLinux 8, fixing CVE-2019-25777 and CVE-2026-20285 in the pure-Perl YAML serialization library. Update with dnf update perl-YAML and restart Perl applications that parse YAML.

High 7.3 CVSS 2026-11-03

AlmaLinux 8

Betroffene Versionen

1.24

Was das unter einer SharedLicense-Lizenz bedeutet

YAML parsing flaws are reached through configuration files and deserialized data — crafted YAML can crash or corrupt the state of Perl scripts that trust it.

Type:

security

Severity:

important

Release date:

2026-11-03

Description:

he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain’t Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, data exchange, and human-readable data storage in Perl applications.

Security Fix(es):

* perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment (CVE-2019-25777)
* perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document (CVE-2017-20285)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
noarch	perl-YAML-1.24-4.module_el8.10.0+4341+ab0ec422.noarch.rpm	7f8a2510ba45af63dd243e3cc1e02ca1a48cea10964c73019b21f729c4c8eb55

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:93471?

It is AlmaLinux's perl-YAML erratum, fixing CVE-2019-25777 and CVE-2026-20285 in the pure-Perl YAML serialization library — note the 2019-year CVE is an old flaw only now backported into the distribution package.

Who is affected?

AlmaLinux 8 servers with perl-YAML installed — Perl applications that read YAML configuration or deserialize YAML data.

How do I apply the fix?

Run dnf update perl-YAML; Perl scripts load the patched module on their next execution. Long-running daemons need a restart.

Why is a 2017-year CVE in this list?

CVE-2017-20285 was assigned retroactively to an old flaw that only recently received a distribution backport — same pattern as the 2019/2022 CVEs appearing in current errata: old bugs, new fixes.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen