CVE-2022-29155Critical· 9.8▾ MidnightIn OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the s…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 12.9 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
64%
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
openldap >= 2.0, < 2.5.12openldap >= 2.6.0, < 2.6.2debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0h300s_firmwareh500s_firmwareh700s_firmwareh700e_firmwareh410s_firmwareh410c_firmwareUpgrade past the affected range:
openldap 2.6.2Connected by shared product, vendor, weakness, or advisory.
CVE-2021-27212High· 7.5In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp
CVE-2020-25710High· 7.5A flaw was found in OpenLDAP in versions before 2.4.56
CVE-2020-25709High· 7.5A flaw was found in OpenLDAP
CVE-2020-36229High· 7.5A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.
CVE-2020-36230High· 7.5A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.
CVE-2020-36227High· 7.5A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.