YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory.

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary     classes.

    A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields,     and Perl calls DESTROY when it goes out of scope.

    What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it     can delete a directory tree the document names. (CVE-2017-20285)

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable,     which can lead to arbitrary code execution.

    A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing     restricts the name, so the target can be @INC or YAML's own load options.

    A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by     default, for every later Load() in the process. A perl/code document is then passed to a string eval, so     an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl     code. (CVE-2019-25777)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8925-1 advisory.

    Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a     user or system were tricked into opening a specially crafted file, an attacker could possibly use this     issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285)

    It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or     automated system were tricked into opening a specially crafted file, an attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-25777)

    It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic     backtracking. If a user or automated system were tricked into opening a specially crafted file, an     attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable,     which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and     supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own     load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading,     which is off by default, for every later Load() in the process. A perl/code document is then passed to a     string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute     arbitrary Perl code. (CVE-2019-25777)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371803	Amazon Linux 2 : perl-YAML (ALAS-2026-4035)	Nessus	Amazon Linux Local Security Checks	Local	critical
366021	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : YAML-LibYAML vulnerabilities (USN-8925-1)	Nessus	Ubuntu Local Security Checks	Local	critical
362963	Linux Distros Unpatched Vulnerability : CVE-2019-25777	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2019-25777

high

Tenable Plugins

critical

critical

high