Severity: High

Description: SAS Environment Manager is susceptible to the following jackson-databind vulnerabilities:

• CVE-2018-7489
• CVE-2017-15095
• CVE-2017-7525

Potential Impact: The application might allow unauthenticated remote code execution.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS Environment Manager 2.5_M2 is available at:

A fix for this issue for SAS Environment Manager 2.5_M1 is available at:

A fix for this issue for SAS Environment Manager 2.5 is available at:

A fix for this issue for SAS Environment Manager 2.3 is available at:

A fix for this issue for SAS Web Server 9.4_M1 is available at:

A fix for this issue for SAS Environment Manager 2.1_M1 is available at:

A fix for this issue for SAS Web Server 9.4 is available at:

A fix for this issue for SAS Environment Manager 2.1 is available at: