This SAS KB article covers known security vulnerabilities with updating or upgrading SAS Web Infrastructure Platform Database.
Severity: Medium
Description: The following versions of PostgreSQL are used as the underlying technology for the SAS Web Infrastructure Platform Data Server:
Updates to these versions of SAS are being offered to keep current with security fixes to PostgreSQL.
These versions of PostgreSQL have known security vulnerabilities.
Potential Impact:
For each SAS Platform release under Standard Support, SAS supports all versions of the major database release delivered. The latest version available for each major PostgreSQL is updated with security fixes. For the security fixes included with each PostgresSQL release, see the open-source PostgreSQL release notes for the major release or the HeroDevs Never-Ending support for PostgreSQL web site.
SAS® 9.4M0 (TS1M0) to SAS® 9.4M5 (TS1M5) delivered PostgreSQL 9.1.x for the SAS® Web Infrastructure Platform Data Server. With the exception of SAS 9.4M5, these databases cannot be updated or upgraded to a later release. The latest release that SAS 9.4M5 can be upgraded to is PostgreSQL 9.4.24, which is currently out of support by the PostgreSQL community. If you require SAS 9.4M5 to be upgraded to that release, contact SAS Technical Support for the manual steps.
The hot fixes in this SAS KB article address the following scenarios:
It is highly recommended that, if you run SAS 9.4M6 and you require security updates to PostgreSQL, you upgrade to SAS 9.4M7 and PostgreSQL 12.x.
If you are unable to update to SAS 9.4M7 at this time but still require PostgreSQL 12.x, then you must contact SAS Technical Support for the paper about how to manually update PostgreSQL 9.x to 12.x.
If you are at SAS 9.4M6 and have already upgraded to PostgreSQL 12, then you can apply the hot fix in this note to update the PostgreSQL database to 12.8.
If you would like to update SAS 9.4M6 to the latest PostgreSQL 9.5.x supported and you have not yet upgraded to PostgreSQL 9.5.x, then you must follow the directions in the documentation Upgrading PostgreSQL.
Once your database is at 9.5.x or if it already is at 9.5.x from an out-of-the-box installation, then you can apply the hot fix in this note to update the PostgreSQL database to 9.5.24.
If you run SAS 9.4M7 and you have not yet upgraded to PostgreSQL 12.x, then you must follow the directions in the documentation Upgrading PostgreSQL if you want to keep receiving security fixes for your PostgreSQL instances.
Once your database is at 12.x or if it is already at 12.x from an out-of-the-box installation, then you can apply the hot fix in this note to update the PostgreSQL database to 12.22.
If you run SAS 9.4M8 and you have not yet upgraded to PostgreSQL 14.x, then you must follow the directions in the documentation Upgrading PostgreSQL if you want to keep receiving security fixes for your PostgreSQL instances.
Once your database is at 14.x, or if it is already at 14.x from an out-of-the-box installation, then you can apply the hot fix in this note to update the PostgreSQL database.
Beginning with PostgreSQL 14.24, the SAS 9.4M8 SAS® Web Infrastructure Platform Data Server uses HeroDevs Never Ending Support (NES) for PostgreSQL 14.
Hot fix M1Y011 updates the SAS Web Infrastructure Platform Data Server to PostgreSQL 14.24 and transitions the PostgreSQL distribution from the open-source PostgreSQL 14 release stream to the HeroDevs NES for PostgreSQL 14 release stream.
The PostgreSQL community support lifecycle for PostgreSQL 14 ends on November 12, 2026. HeroDevs NES for PostgreSQL 14 enables SAS 9.4M8 customers to remain on a supported PostgreSQL 14 platform through the SAS 9.4M8 support lifecycle, including the SAS Limited Support date of February 1, 2028.
Customers running SAS 9.4M8 are encouraged to apply Hot Fix M1Y011 to remain current with PostgreSQL security updates and support coverage.
If you run SAS 9.4M9 and you have not yet upgraded to PostgreSQL 16.x, then you must follow the directions in the documentation Upgrading PostgreSQL if you want to keep receiving security fixes for your PostgreSQL instances.
Once your database is at 16.x, or if it is already at 16.x from an out-of-the-box installation, then you can apply the hot fix in this note to update the PostgreSQL database to 16.14.
Note that when you perform the upgrade, sometimes the cursor is not returned to the user. The upgrade appears to stop responding after it reports that all databases have been upgraded. It is safe to press Ctrl-C to exit the upgrade at this point.