DSA-5140: -1 openldap -- security update

Published May 19, 2022

Updated

Jacek Konieczny discovered a SQL injection vulnerability in the back-sql backend to slapd in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol, allowing an attacker to alter the database during an LDAP search operation when a specially crafted search filter is processed.

Affected Software

2 affected components

debian/openldap

Event History

May 19, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-29155

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue is in the back-sql backend of slapd. Deployments that do not use this backend are not identified as affected by the provided information.

What must an attacker do to exploit the vulnerability?

An attacker must cause slapd to process a specially crafted LDAP search filter. Successful exploitation can allow alteration of the database during the LDAP search operation.

DSA-5140: -1 openldap -- security update

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?