Severity: Medium

Description: The SAS Environment Manager server and agent contain JCraft and JSch libraries that are vulnerable to directory traversal (CVE-2016-5725).

Potential Impact: Users might gain unauthorized access to the file system.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS Environment Manager 2.5_M1 is available at:

A fix for this issue for SAS Environment Manager Agent 2.5_M1 is available at:

A fix for this issue for SAS Environment Manager Agent 2.5 is available at:

A fix for this issue for SAS Environment Manager 2.5 is available at:

A fix for this issue for SAS Environment Manager Agent 2.3 is available at:

A fix for this issue for SAS Environment Manager 2.3 is available at:

A fix for this issue for SAS Environment Manager 2.1_M1 is available at:

A fix for this issue for SAS Web Server 9.4_M1 is available at:

A fix for this issue for SAS Environment Manager Agent 2.1 is available at:

A fix for this issue for SAS Environment Manager 2.1 is available at:

A fix for this issue for SAS Web Server 9.4 is available at: