To keep current with bug fixes in the Progress / DataDirect ODBC driver, SAS has updated the current Microsoft SQL Server 8.0.2 for SAS^® 9.4M7 (TS1M7), SAS^® 9.4M8 (TS1M8), and SAS^® Viya^® 3.5.

Severity: Low

Description: The Progress / DataDirect driver for SQL Server contains a component with known vulnerabilities. For details, see the following:

• Intermittent issues with updates to DATETIME data types with fractional seconds
• Buffer over runs in the ODBC driver manager
• Active Directory fixes occur when connecting to Microsoft Azure (not Azure AD Tokens)
• CVE-2022-42915 (SAS 9.4M8 only)
• Update the Curl library to 08.02.0729

Potential Impact:

• SEGV issues might occur.
• An attacker might gain unauthorized information.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Applying the hot fix brings the current SQL Server driver up to the latest version that SAS supports for that version of software.

Operating System and Release Information

Viya on Linux: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Linux Deployment Guide at

A fix for this issue for DataDirect ODBC Driver for Microsoft SQL Server 9.45 is available at:

A fix for this issue for DataDirect ODBC Driver for Microsoft SQL Server 9.44 is available at: