Red Hat Fixes Perl YAML Code Execution Paths on RHEL 8
Tech GuruQuick Answer
The Perl YAML update addresses unrestricted package-variable assignment and crafted-document destructor execution, CVE-2019-25777 and CVE-2017-20285. Match installed packages and support entitlements to the errata, apply the supported fixes, validate service operation, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory the active perl-YAML module, automation and applications parsing YAML, and whether documents come from untrusted sources. Match product, architecture, package epoch/version/release and support stream to the individual erratum; apply each CVE only where its documented prerequisites hold. Install the exact perl-YAML:1.24 module package set in RHSA-2026:93471, preserving the supported module context. Verify package and module builds and test configuration loading and automation jobs; retain dependency and execution evidence.
Last verified: 2026-11-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | perl-YAML:1.24 module on RHEL 8 AppStream |
|---|---|
| Advisory | RHSA-2026:93471 |
| CVEs | CVE-2017-20285, CVE-2019-25777 |
| Authoritative release date | 2026-11-02T03:52:24Z (latest release in this group; individual release dates below) |
| Authority revision date | 2026-11-02T03:53:20Z (latest authority revision in this group) |
| Affected versions | Advisory-listed packages before the corresponding fixed builds on Red Hat Enterprise Linux AppStream (v. 8). |
| Fixed version | perl-YAML-0:1.24-4.module+el8.10.0+25073+42d87e53.src::perl-YAML:1.24; perl-YAML-0:1.24-4.module+el8.10.0+25073+d1062575.src::perl-YAML:1.24 |
| CVSS base score | 7.4-8.1 (CVSS v3.1; CVE-specific) |
| CVSS severity | High |
| Exploitation status | The cited Red Hat advisories do not state that these issues are being maliciously exploited.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| RHSA-2026:93471 | Released 2026-11-02T03:52:24Z; revised 2026-11-02T03:53:20Z. Red Hat Enterprise Linux AppStream (v. 8). Fixed source package families: perl-YAML-0:1.24-4.module+el8.10.0+25073+42d87e53.src::perl-YAML:1.24; perl-YAML-0:1.24-4.module+el8.10.0+25073+d1062575.src::perl-YAML:1.24. CVSS: 7.4-8.1 (CVSS v3.1; CVE-specific); High. Vendor rating: Important. |
|---|
What Changed
The Perl YAML update addresses unrestricted package-variable assignment and crafted-document destructor execution, CVE-2019-25777 and CVE-2017-20285.
What To Validate Now
- Inventory. Inventory the active perl-YAML module, automation and applications parsing YAML, and whether documents come from untrusted sources.
- Establish applicability. Match product, architecture, package epoch/version/release and support stream to the individual erratum; apply each CVE only where its documented prerequisites hold.
- Remediate. Install the exact perl-YAML:1.24 module package set in RHSA-2026:93471, preserving the supported module context.
- Validate. Verify package and module builds and test configuration loading and automation jobs; retain dependency and execution evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Continue to treat untrusted serialized objects as untrusted input. A current advisory can legitimately fix older CVE identifiers. CVSS values are the authority-provided per-CVE scores, not a score for the whole update. Retain the advisory, inventory, approval, package and validation records.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
