Severity: Medium

Description: JDBC 42.2.x is used in SAS^® 9.4M7 (TS1M7)  and SAS^® 9.4M8 (TS1M8) as the underlying technology for some SAS clients to access the SAS Web Infrastructure Platform Data Server. This version of JDBC driver ​​​​​has the following known security vulnerabilities: 

• ​​​​​​​​​​​​​​​​​​Vulnerability Summary for CVE-2022-41946 (SAS 9.4M8 only)
• Vulnerability Summary for CVE-2022-31197
• Vulnerability Summary for CVE-2022-21724
• Vulnerability Summary for CVE-2020-13692

Potential Impact: This security concern can have the following impact:

• improper restriction of the XML external entity reference
• allows the attacker to control the JDBC URL or properties

Click the Hot Fix tab in this note to access the hot fix for this issue.

Applying this hot fix brings the JDBC driver up to level 42.2.27 (SAS 9.4M7) and  level 42.6.0 (SAS 9.4M8).

Operating System and Release Information

A fix for this issue for SAS Web Infrastructure Data Base JDBC Drivers 9.43 is available at:

A fix for this issue for SAS Web Infrastructure Data Base JDBC Drivers 9.42 is available at:

A fix for this issue for SAS Web Infrastructure Data Base JDBC Drivers 9.41 is available at: