Postgres CVE-2020-13692

[paterd2]

Good day.

I got a question concerning the following.

Is  SAS 9.4 vulnerable for the following postgres flaw ?

Description of problem:

An XML eXternal Entity (XXE) flaw was discovered in the PgSQLXML implementation that is known as CVE-2020-13692. This flaw could possibly allow disclosure of confidential data (such as content of local files), denial of service, server side request forgery (SSRF), or other impacts, if specially crafted XML documents are processed by PgSQLXML.

In order to fix the CVE-2020-13692 issue, the PgSQLXML implementation in postgresql-jdbc was modified to disable loading of external entities and document type definitions (DTD) by default. This change may introduce a regression in environments that rely on processing of external entities or DTDs.

For environments that require processing of external entities or DTDs, it is possible to configured PgSQLXML to use the previous behaviour and perform loading of external objects. This legacy behaviour can be enabled for each database connection by setting the xmlFactoryFactory property to the value of LEGACY_INSECURE.

Note: This setting enables processing of external entities and DTDs and therefore re-introduces the CVE-2020-13692 issue. It should only be used when XML documents stored in a database and processed using the PgSQLXML are fully trusted.

[AnandVyas · Accepted solution]

Hi @paterd2 

You can find the security bulletins and vulnerabilities related information from SAS at this site: https://support.sas.com/en/security-bulletins.html#security-bulletins

I don't see the postgres one listed. I would suggest you to raise a technical support track to get it confirmed. You can raise a track by emailing the details to support@sas.com