Summary
It was discovered that OpenLDAP incorrectly handled certain SQL statements
within LDAP queries in the experimental back-sql backend. A remote attacker
could possibly use this issue to perform an SQL injection attack and alter
the database.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openldap | 2.4.45+dfsg-1ubuntu1.11 |
| Ubuntu · 20.04 LTS 20.04:LTS | openldap | 2.4.49+dfsg-2ubuntu1.9 |
| Ubuntu · 22.04 LTS 22.04:LTS | openldap | 2.5.11+dfsg-1~exp1ubuntu3.1 |
Vulnerabilities 1
-
Unscored —CVE-2022-29155 EPSS 64%
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql…
References
-
report
https://ubuntu.com/security/CVE-2022-29155