Apache Shiro CVE-2022-40664 Vulnerability

shoin — Thu, 10 Nov 2022 17:40:38 GMT

Hello, there's a SAS note on Apache Shiro CVE-2022-40664 vulnerability for SAS Viya https://support.sas.com/kb/66/541.html addressing
CVE-2020-11989 Detail at https://nvd.nist.gov/vuln/detail/CVE-2020-11989.

however, none for the Apache Shiro vulnerability CVE-2022-40664 for either Viya 3.5 or 4.0 and specifically for AS 9.4, is a note planned?

-S

Re: Apache Shiro CVE-2022-40664 Vulnerability

ChrisHemedinger — Fri, 11 Nov 2022 13:43:06 GMT

Hi @shoin - I recommend that you open a track with SAS Technical Support. This is the preferred method to exchange information about CVE questions until a bulletin is posted (and a bulletin would be posted only if deemed necessary).

topic Re: Apache Shiro CVE-2022-40664 Vulnerability in Administration and Deployment

Apache Shiro CVE-2022-40664 Vulnerability

Re: Apache Shiro CVE-2022-40664 Vulnerability