The Secure Sockets Layer (SSL) capability in SAS Foundation products supports SSL 3.0. As a result, it is susceptible to the POODLE vulnerability that is described in the following documents:

• https://www.us-cert.gov/ncas/alerts/TA14-290A
• https://www.openssl.org/~bodo/ssl-poodle.pdf

The SSL capability can be used in SAS Foundation products in a variety of ways, for example:

• a SAS/CONNECT^® spawner configured for SSL or its successor, Transport Layer Security (TLS)
• a SAS/SHARE^® server configured for SSL or TLS
• a LIBNAME URL or a LIBNAME WebDAV statement that specifies an HTTPS URL
• an HTTP procedure or SOAP procedure step that specifies an HTTPS URL
• a SAS^® Metadata Server that is configured for direct use of Lightweight Directory Access Protocol (LDAP) authentication using SSL or TLS

Please contact SAS Technical Support to obtain the hot fix for this issue.

Operating System and Release Information

A fix for this issue for Base SAS 9.4_M2 is available at:

A fix for this issue for SAS/Secure SSL 9.4_M2 is available at:

A fix for this issue for Base SAS 9.4_M1 is available at:

A fix for this issue for SAS/Secure SSL 9.4_M1 is available at:

A fix for this issue for Base SAS 9.4 is available at:

A fix for this issue for SAS/Secure SSL 9.4 is available at:

A fix for this issue for Base SAS 9.3_M2 is available at:

A fix for this issue for SAS/Secure SSL 9.3_M2 is available at:

A fix for this issue for Base SAS 9.3_M1 is available at:

A fix for this issue for SAS/Secure SSL 9.3_M1 is available at:

A fix for this issue for SAS/Secure SSL 9.2_M3 is available at: