Severity: High

Description: SAS^® Infrastructure Data Server 9.4, which functions as a PostgreSQL database, is delivered with SAS^® Viya^® 3.4. The following security concerns related to PostgreSQL are present in this release of the SAS data server: 

• CVE-2018-10915
• CVE-2019-10127
• CVE-2019-10128
• CVE-2019-10208
• CVE-2019-10210
• CVE-2019-10211

Potential Impact:

• Unprivileged users might be able to execute arbitrary code as the PostgreSQL service account.
• A flaw was discovered in PostgreSQL in which arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

Updating the PostgreSQL server from 9.4 to 9.4.24 addresses all of these security concerns.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

An update for this issue is available for SAS Viya 3.3. For instructions on how to access and apply software updates, see the Managing Your Software section of the SAS Viya 3.3 Administration document at

An update for this issue is available for SAS Viya 3.2. For instructions on how to access and apply software updates, see the Software Updates section of the SAS Viya 3.2 Administration document at

An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Windows Deployment Guide at

An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at

Viya on Linux: An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at

A fix for this issue for SAS Web Infrastructure Platform Data Server 9.4_M6 is available at: