SAS Product Security
Latest bulletins and updates
Security Bulletins
| Title | Date${releaseDate|N/A} | Severity | Description | CVE |
|---|
| Severity | CVSS Range |
|---|---|
| Informational | 0.0 |
| Low | 0.1 - 3.9 |
| Medium | 4.0 - 6.9 |
| High | 7.0 - 8.9 |
| Critical | 9.0 - 10.0 |
Note: Hot fixes for each product component are cumulative and might include functionality fixes in addition to security fixes. For a list of hot fixes that are available for your products, use the the SAS Hot Fix Analysis, Download & Deployment (SASHFADD) tool. See the Hot Fix FAQ for a general overview of hot fixes.
Note: To ensure that SAS customers have the latest security updates for SAS software, SAS recommends that customers install the most current release of the software, including maintenance and security hot fixes.
Java 21, 11, 8, and 7 Updates
SAS provides a version of the required Java Runtime Environment (JRE) along with SAS 9.4 software (known as the “SAS Private JRE”). SAS partners with Azul to deliver and test Java updates that contain security fixes and improvements for an existing Java version. SAS makes these updates available from the SAS Downloads Site for SAS 9.4 releases under Standard Support on a regular basis.
SAS recommends that you update your SAS Private JRE when update packages are made available by SAS. SAS also recommends that you check for update availability regularly.
Updates to the SAS Private JRE are performed separately from the application of regular security updates and hot fixes. For more information, see Preparing the SAS Software Depot with Security Updates and Hot Fixes.
SAS delivers regular updates of the SAS Private JRE as follows:
- Java 21 for use with SAS® 9.4M9 (TS1M9) - Download updates for Java 21
- Java 11 for use with SAS® 9.4M8 (TS1M8) - Download updates for Java 11
Note: SAS 9.4M8 environments on z/OS and z64 use Java 8 - Java 8 for use with SAS® 9.4M7 (TS1M7) and SAS® 9.4M6 (TS1M6) - Download updates for Java 8
In alignment with the SAS 9.4 Java vendor, SAS updates for Java 7 and earlier are no longer available. See the Azul Support lifecycle for existing and planned JDK releases. SAS continues to provide the last Java 7 update, which was released by SAS in August 2022. Download updates for Java 7.
See SAS Third-Party Software Requirements for details.
See also SAS Note 56203 for the updates to the Java 21, Java 11, Java 8, and Java 7 JREs and JDKs.
Vulnerability Notes
| Title | Date | Severity | Product |
|---|
Product Security Incident Response Team
To keep you informed about any suspected or confirmed security issues, SAS publishes security bulletins and SAS Notes as part of our formal Product Security Incident Response Team (PSIRT) process.
Customers who have SAS support contracts should report a suspected security issue by opening a case with SAS Technical Support. Security researchers or others who do not have a support contract can contact PSIRT directly by sending email to psirt@sas.com.