Severity: Low

Description: The SAS 9.4 ODBC driver for PostgreSQL contains a component with known vulnerabilities. For details, see the following:

• CVE-2023-39417
• CVE-2023-2455
• CVE-2023-2454
• CVE-2022-37434
• CVE-2022-2068
• CVE-2022-1292
• CVE-2022-0778
• CVE-2021-23222
• CVE-2021-23214
• CVE-2021-3393

Potential Impact:

• An attacker might gain unauthorized access to information (that is, unauthorized information disclosure can occur).
• A server processes unencrypted bytes from a man-in-the-middle.
• Removes outdated libcrypto-1_1.dll and libss-1_1.dll on W32 environments.
• Relocates libssl.so.3 and libcrypto.so.3 from <SASHome>/SASODBCDriversfortheWebInfrastructurePlatformDataServer/9.4/Driver to <SASHome>/SASODBCDriversfortheWebInfrastructurePlatformDataServer/9.4/Driver/lib64 to avoid conflicts with other SAS solutions such as SAS^® Cost and Profitability Management.  (SAS 9.4M8 LAX only)

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS ODBC Drivers for the Web Infrastructure Platform Data Server 9.47 is available at:

A fix for this issue for SAS ODBC Drivers for the Web Infrastructure Platform Data Server 9.46 is available at:

A fix for this issue for SAS ODBC Drivers for the Web Infrastructure Platform Data Server 9.45 is available at: