CVE-2022-29155

    Dashboard / Vulnerabilities / CVE-2022-29155

    CVE-2022-29155

    Published: 4 May 2022Last Modified: 23 Sept 2026

    Summary:

    Details: In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

    References: https://bugs.openldap.org/show_bug.cgi?id=9815, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29155.json, https://nvd.nist.gov/vuln/detail/CVE-2022-29155, https://security.netapp.com/advisory/ntap-20220609-0007/, https://www.debian.org/security/2022/dsa-5140, https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9794f9fbe87267e8323c44a260abd2656d1652e7
    Fixed -2bda1fa98fbcedc6cd5995ea905427b8bef89f9d

    Affected versions

    OPENLDAP_REL_ENG_2_6_1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29155 | CVE-DB