Severity: High

Description: SAS Web Server contains the following vulnerabilities:

• CVE-2024-40898
• ​​​​​CVE-2024-40725
• CVE-2024-4741
• CVE-2024-39884 
• CVE-2024-39573
• CVE-2024-38477
• CVE-2024-38476  
• CVE-2024-38475 
• CVE-2024-38474 
• CVE-2024-38473
• CVE-2024-38472 
• CVE-2024-36387
• CVE-2024-4603
• CVE-2024-2511 ​​​​​​

Potential Impact: Refer to the CVE records above for details. 

Click the Hot Fix tab in this note to access the hot fix for this issue. 

Operating System and Release Information

Product Family	Product	System	Product Release		SAS Release
			Reported	Fixed*	Reported	Fixed*
SAS System	SAS Web Server	Solaris for x64	9.45	9.45	9.4 TS1M6	9.4 TS1M6
		Linux for x64	9.45	9.45	9.4 TS1M6	9.4 TS1M6
		HP-UX IPF	9.45	9.45	9.4 TS1M6	9.4 TS1M6
		64-bit Enabled Solaris	9.45	9.45	9.4 TS1M6	9.4 TS1M6
		64-bit Enabled AIX	9.45	9.45	9.4 TS1M6	9.4 TS1M6
		Microsoft® Windows® for x64	9.45	9.45	9.4 TS1M6	9.4 TS1M6

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

---

A fix for this issue for SAS Web Server 9.47 is available at:

https://tshf.sas.com/techsup/download/hotfix/HF2/M1V.html#70951

---

A fix for this issue for SAS Web Server 9.46 is available at:

https://tshf.sas.com/techsup/download/hotfix/HF2/J8M.html#70951

---

A fix for this issue for SAS Web Server 9.45 is available at:

https://tshf.sas.com/techsup/download/hotfix/HF2/E8D.html#70951

---

SAS® Web Server contains the following known vulnerabilities: CVE-2024-40725 CVE-2024-39884 CVE-2024-39573 CVE-2024-38477 CVE-2024-38476 CVE-2024-38475 CVE-2024-38474 CVE-2024-38473 CVE-2024-38472 CVE-2024-36387 CVE-2024-2511

Type:	Problem Note
Priority:	high

Date Modified:	2024-09-04 09:50:16
Date Created:	2024-08-29 13:49:28