CVE-2022-29155 SQL injection in n/a
SQL injection in OpenLDAP's experimental back-sql backend allows attackers to manipulate database queries via LDAP search filters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29155?
CVE-2022-29155 is a critical SQL injection vulnerability in Debian Debian Linux, published on 4 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
Weakness: CWE-89
Which versions are affected by CVE-2022-29155?
1 open source package ship an affected version, including openldap. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
openldap Bitnami | From 2.0.0 | 2.5.12, 2.6.2 |
Linux distribution packages (39)
openldap2 SUSE:Enterprise Storage 6 | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Enterprise Storage 7 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:HPE Helion OpenStack 8 | All versions | 2.4.41-18.89.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Micro 5.1 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Micro 5.2 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Module for Development Tools 15 SP4 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Module for Legacy 12 | All versions | 2.4.41-42.1 |
openldap2 SUSE:Linux Enterprise Module for Legacy 15 SP3 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 2.4.41-18.89.1 |
openldap2 SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 2.4.41-18.89.1 |
openldap2 SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 2.4.41-18.89.1 |
openldap2 SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 2.4.41-22.10.1 |
openldap2 SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.4.41-22.10.1 |
openldap2 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Server 15-LTSS | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.4.41-18.89.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.4.41-42.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.4.41-22.10.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.4.41-42.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.4.41-22.10.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.4.41-42.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 2.4.46-150000.9.71.1 |
openldap2 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.4.41-22.10.1 |
openldap2 SUSE:Manager Proxy 4.1 | All versions | 2.4.46-150200.14.8.1 |
openldap2 SUSE:Manager Retail Branch Server 4.1 | All versions | 2.4.46-150200.14.8.1 |
Products include Debian Debian Linux, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700e Firmware and 2 more.
How do I fix CVE-2022-29155?
Upgrade openldap to a fixed version for your release line: 2.5.12 or 2.6.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-29155 being exploited?
There is no known exploitation of CVE-2022-29155 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-29155, AZL-9672, BIT-openldap-2022-29155, CLEANSTART-2026-YM99872, CLSA-2022-1652986454, CLSA-2022-1652986513 and 16 more.