Type Confusion in python-ldap - CVE-2025-61911

Vulnerability identifier: #VU116911

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-61911

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a type confusion error in ldap.filter.escape_filter_chars. A remote attacker can perform ldap injection attack and disclose or manipulate ldap data.

python-ldap
SUSE Multi-Linux Manager Retail Branch Server 5.1 Extension for
SUSE Multi-Linux Manager Proxy 5.1 Extension for
SUSE Multi-Linux Manager Server 5.1 Extension for
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
IBM Maximo Application Suite
python-ldap (Ubuntu package)
python-ldap-help
python3-ldap
python-ldap
python-ldap-debuginfo
python-ldap-debugsource
python3-ldap-debuginfo
suse-multi-linux-manager-5.1-x86_64-server-postgresql-image
suse-multi-linux-manager-5.1-aarch64-server-postgresql-image
suse-multi-linux-manager-5.1-s390x-server-postgresql-image
suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image
suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image
suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image
suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image
suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image
suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image
suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image
suse-multi-linux-manager-5.1-x86_64-proxy-squid-image
suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image
suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image
suse-multi-linux-manager-5.1-s390x-proxy-squid-image
suse-multi-linux-manager-5.1-s390x-proxy-ssh-image
suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image
suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image
suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image
suse-multi-linux-manager-5.1-aarch64-proxy-squid-image
suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image
suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image
suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image
suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image
suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image
suse-multi-linux-manager-5.1-x86_64-server-image
suse-multi-linux-manager-5.1-s390x-server-image
suse-multi-linux-manager-5.1-ppc64le-server-image
suse-multi-linux-manager-5.1-aarch64-server-image
suse-multi-linux-manager-5.1-x86_64-server-attestation-image
suse-multi-linux-manager-5.1-s390x-server-attestation-image
suse-multi-linux-manager-5.1-ppc64le-server-attestation-image
suse-multi-linux-manager-5.1-aarch64-server-attestation-image
suse-multi-linux-manager-5.1-s390x-proxy-httpd-image
suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image
suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image
suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image
suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image
suse-multi-linux-manager-5.1-x86_64-server-saline-image
suse-multi-linux-manager-5.1-aarch64-server-saline-image
suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image
suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image
suse-multi-linux-manager-5.1-ppc64le-server-saline-image
suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image
suse-multi-linux-manager-5.1-s390x-server-saline-image
mgrctl-lang
mgrpxy
mgrpxy-debuginfo
mgrpxy-bash-completion
mgradm-debuginfo
mgrpxy-zsh-completion
mgrctl-debuginfo
mgrpxy-lang
mgrctl
mgradm
mgradm-zsh-completion
mgradm-lang
mgrctl-zsh-completion
mgrctl-bash-completion
mgradm-bash-completion

Install updates from vendor's website.

python-ldap - update to 3.4.5
IBM Maximo Application Suite - addressed in versions 8.10.36, 8.11.33, 9.0.22, 9.1.11
python-ldap (Ubuntu package) - addressed in versions 2.4.22-0.1ubuntu0.1~esm1, 3.0.0-1ubuntu0.2+esm1, 3.2.0-4ubuntu2.1+esm1, 3.2.0-4ubuntu7.2, 3.4.4-1ubuntu0.24.04.1, 3.4.4-1ubuntu0.25.04.1, 3.4.4-1ubuntu0.25.10.1
python-ldap-help - addressed in versions 3.1.0-6, 3.3.1-7, 3.4.4-3
python3-ldap - addressed in versions 3.1.0-6, 3.3.1-7, 3.4.4-3
python-ldap - addressed in versions 3.1.0-6, 3.3.1-7, 3.4.4-3
python-ldap-debuginfo - update to 3.1.0-150100.3.5.1
python-ldap-debugsource - addressed in versions 3.1.0-150100.3.5.1, 3.4.0-150400.3.3.1
python-ldap-debugsource - addressed in versions 3.3.1-7, 3.4.4-3
python-ldap-debuginfo - addressed in versions 3.3.1-7, 3.4.4-3
python3-ldap-debuginfo - update to 3.4.0-150400.3.3.1
python3-ldap - update to 3.4.0-150400.3.3.1
suse-multi-linux-manager-5.1-x86_64-server-postgresql-image - update to 5.1.1.1-6.8.1
suse-multi-linux-manager-5.1-aarch64-server-postgresql-image - update to 5.1.1.1-6.8.1
suse-multi-linux-manager-5.1-s390x-server-postgresql-image - update to 5.1.1.1-6.8.1
suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image - update to 5.1.1.1-6.8.1
suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image - update to 5.1.1.1-8.8.2
suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image - update to 5.1.1.1-8.8.2
suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image - update to 5.1.1.1-8.8.2
suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image - update to 5.1.1.1-8.8.2
suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-x86_64-proxy-squid-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-s390x-proxy-squid-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-s390x-proxy-ssh-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-aarch64-proxy-squid-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image - update to 5.1.1.1-8.8.3
suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image - update to 5.1.1.1-8.8.6
suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image - update to 5.1.1.1-8.8.6
suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image - update to 5.1.1.1-8.8.6
suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image - update to 5.1.1.1-8.8.6
suse-multi-linux-manager-5.1-x86_64-server-image - update to 5.1.1.1-8.8.11
suse-multi-linux-manager-5.1-s390x-server-image - update to 5.1.1.1-8.8.11
suse-multi-linux-manager-5.1-ppc64le-server-image - update to 5.1.1.1-8.8.11
suse-multi-linux-manager-5.1-aarch64-server-image - update to 5.1.1.1-8.8.11
suse-multi-linux-manager-5.1-x86_64-server-attestation-image - update to 5.1.1.1-8.10.3
suse-multi-linux-manager-5.1-s390x-server-attestation-image - update to 5.1.1.1-8.10.3
suse-multi-linux-manager-5.1-ppc64le-server-attestation-image - update to 5.1.1.1-8.10.3
suse-multi-linux-manager-5.1-aarch64-server-attestation-image - update to 5.1.1.1-8.10.3
suse-multi-linux-manager-5.1-s390x-proxy-httpd-image - update to 5.1.1.1-8.10.8
suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image - update to 5.1.1.1-8.10.8
suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image - update to 5.1.1.1-8.10.8
suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image - update to 5.1.1.1-8.10.8
suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-x86_64-server-saline-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-aarch64-server-saline-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-ppc64le-server-saline-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image - update to 5.1.1.1-9.8.11
suse-multi-linux-manager-5.1-s390x-server-saline-image - update to 5.1.1.1-9.8.11
mgrctl-lang - update to 5.1.23-150700.3.10.1
mgrpxy - update to 5.1.23-150700.3.10.1
mgrpxy-debuginfo - update to 5.1.23-150700.3.10.1
mgrpxy-bash-completion - update to 5.1.23-150700.3.10.1
mgradm-debuginfo - update to 5.1.23-150700.3.10.1
mgrpxy-zsh-completion - update to 5.1.23-150700.3.10.1
mgrctl-debuginfo - update to 5.1.23-150700.3.10.1
mgrpxy-lang - update to 5.1.23-150700.3.10.1
mgrctl - update to 5.1.23-150700.3.10.1
mgradm - update to 5.1.23-150700.3.10.1
mgradm-zsh-completion - update to 5.1.23-150700.3.10.1
mgradm-lang - update to 5.1.23-150700.3.10.1
mgrctl-zsh-completion - update to 5.1.23-150700.3.10.1
mgrctl-bash-completion - update to 5.1.23-150700.3.10.1
mgradm-bash-completion - update to 5.1.23-150700.3.10.1

• Exploit #12023 - Sanitization bypass in ldap.filter.escape_filter_chars (October 13, 2025)

• https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r7r6-cc7p-4v5m

• Multiple vulnerabilities in python-ldap
• Ubuntu update for python-ldap
• SUSE update for python-ldap
• openEuler 22.03 LTS SP3 update for python-ldap
• openEuler 20.03 LTS SP4 update for python-ldap
• openEuler 24.03 LTS SP2 update for python-ldap
• openEuler 24.03 LTS SP1 update for python-ldap
• openEuler 24.03 LTS update for python-ldap
• openEuler 22.03 LTS SP4 update for python-ldap
• SUSE update for python-ldap
• SUSE update for Maintenance update for Multi-Linux Manager 5.1.1.1: Server, Proxy and Retail Branch Server
• Multiple vulnerabilities in IBM Maximo Application Suite