Severity: High
Description: SAS® Hadoop Configuration Libraries 2.6 includes jackson-databind 2.9.9.3 and 2.9.5 libraries that have known vulnerabilities:
Potential Impact: A polymorphic typing issue in the affected jackson-databind libraries create a potential remote-code execution vulnerability. SAS® products do not use the affected functionality, but these libraries might be flagged by a security scan.
Resolving this issue requires upgrading the SAS Hadoop Configuration Libraries to version 2.7. For more information, see SAS Maintenance Releases and Product Upgrades or contact SAS Technical Support for further assistance.