Severity: High

Description: When using the SAS^® 9.4 SASHDAT engine or SAS^® Viya^® Cloud Analytic Services (CAS) actions to save files to HDFS in SASHDAT format, you encounter a security vulnerability. In this scenario, permissions on saved SASHDAT files incorrectly default to 666 (Read and Write access for all) when you do not specify a permission setting. Instead, the behavior when you do not specify permissions should be that the default HDFS umask is applied to the file. The default HDFS unmask is generally derived from hdfs-site.xml settings such as dfs.umaskmode or fs.permissions.umask-mode.

Potential Impact: SASHDAT files can be read, modified, or deleted by any user with access to the HDFS directory that contains these files.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at

A fix for this issue for SAS Plug-ins for Hadoop 1.02 is available at: