SQL injection in OpenLDAP - CVE-2022-29155

Vulnerability identifier: #VU63343

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29155

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the experimental back-sql backend to slapd during an LDAP search operation when the search filter is processed. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

OpenLDAP
PowerStore 9000X
PowerStore 1000X
PowerStore 5000X
PowerStore 3000X
PowerStore 7000X
Fujitsu M12-2S
Fujitsu M12-2
Fujitsu M12-1
PowerStoreX OS
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fujitsu M10-4
Fujitsu M10-4S
Fujitsu M10-1
EMC ECS
Platform Automation Toolkit
openldap (Debian package)
openldap2-ppolicy-check-password
openldap2-ppolicy-check-password-debuginfo
compat-libldap-2_3-0
compat-libldap-2_3-0-debuginfo
openldap
openldap2-debugsource
openldap2-debuginfo
openldap2-client-debuginfo
openldap2-client
openldap2-back-meta-debuginfo
openldap2-back-meta
openldap2
libldap-2_4-2-debuginfo-32bit
libldap-2_4-2-debuginfo
libldap-2_4-2
openldap2-doc
libldap-2_4-2-32bit
openldap2-back-perl-debuginfo
openldap2-back-perl
openldap2-devel
openldap2-devel-static
slapd (Ubuntu package)
libldap-data
openldap2-devel-32bit
libldap-2_4-2-32bit-debuginfo
openldap2-back-sql
openldap2-contrib-debuginfo
openldap2-contrib
openldap2-back-sql-debuginfo
openldap2-back-sock-debuginfo
openldap2-back-sock
openldap-servers
openldap-clients
openldap-devel
openldap-debugsource
openldap-debuginfo
openldap-help
Dell EMC NetWorker vProxy
Splunk Enterprise
Dell Secure Connect Gateway
Isolation Segment
VMware Tanzu Application Service for VMs
HPE Moonshot 1500 Chassis Manager
Dell EMC Storage Monitoring and Reporting (SMR)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC VxRail Appliance

Install update from vendor's website.

OpenLDAP - addressed in versions 2.5.12, 2.6.2
openldap (Debian package) - addressed in versions 2.4.47+dfsg-3+deb10u7, 2.4.57+dfsg-3+deb11u1
Dell EMC NetWorker vProxy - addressed in versions 4.3.0-31, 4.3.0-32
Dell Secure Connect Gateway - update to 5.12.00.10
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
openldap2-ppolicy-check-password - addressed in versions 1.2-18.89.1, 1.2-22.10.1, 1.2-150000.9.71.1, 1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo - addressed in versions 1.2-18.89.1, 1.2-22.10.1, 1.2-150000.9.71.1, 1.2-150200.14.8.1
compat-libldap-2_3-0 - update to 2.3.37-42.1
compat-libldap-2_3-0-debuginfo - update to 2.3.37-42.1
openldap - update to 2.4.40-16.32
openldap2-debugsource - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-debuginfo - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-client-debuginfo - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-client - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-meta - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2 - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-32bit - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1
libldap-2_4-2-debuginfo - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
libldap-2_4-2 - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-doc - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150200.14.8.1
libldap-2_4-2-32bit - addressed in versions 2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo - addressed in versions 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-perl - addressed in versions 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-devel - addressed in versions 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-devel-static - addressed in versions 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
slapd (Ubuntu package) - addressed in versions 2.4.42+dfsg2ubuntu3.13+esm1, 2.4.45+dfsg-1ubuntu1.11, 2.4.49+dfsg-2ubuntu1.9, 2.5.6+dfsg-1~exp1ubuntu1.1, 2.5.11+dfsg-1~exp1ubuntu3.1
libldap-data - addressed in versions 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-devel-32bit - addressed in versions 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo - addressed in versions 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-sql - update to 2.4.46-150200.14.8.1
openldap2-contrib-debuginfo - update to 2.4.46-150200.14.8.1
openldap2-contrib - update to 2.4.46-150200.14.8.1
openldap2-back-sql-debuginfo - update to 2.4.46-150200.14.8.1
openldap2-back-sock-debuginfo - update to 2.4.46-150200.14.8.1
openldap2-back-sock - update to 2.4.46-150200.14.8.1
openldap-servers - update to 2.4.50-7
openldap-clients - update to 2.4.50-7
openldap-devel - update to 2.4.50-7
openldap-debugsource - update to 2.4.50-7
openldap-debuginfo - update to 2.4.50-7
openldap - update to 2.4.50-7
openldap-help - update to 2.4.50-7
Isolation Segment - addressed in versions 2.7.45, 2.10.25, 2.11.14, 2.12.8
VMware Tanzu Application Service for VMs - addressed in versions 2.7.50, 2.10.32, 2.11.20, 2.12.13, 2.13.5
PowerStoreX OS - update to 3.2.1.6-2476179
EMC ECS - update to 3.7.0.3
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.8.0.0
Dell EMC Unity Operating Environment (OE) - update to 5.2.1.0.5.013
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.1.0.5.013
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.1.0.5.013
Dell EMC VxRail Appliance - addressed in versions 7.0.372, 8.0.000

• https://bugs.openldap.org/show_bug.cgi?id=9815

• SQL injection in OpenLDAP
• Ubuntu update for openldap
• Ubuntu update for openldap
• Debian update for openldap
• Amazon Linux AMI update for openldap
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in Dell EMC NetWorker vProxy
• Multiple vulnerabilities in Dell ECS
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell VxRail Appliance components
• Amazon Linux AMI update for openldap
• SUSE update for openldap2
• SUSE update for openldap2
• SUSE update for openldap2
• SUSE update for openldap2
• SUSE update for openldap2
• VMware Tanzu products update for OpenLDAP
• Multiple vulnerabilities in Fujitsu M12-2S
• Multiple vulnerabilities in Fujitsu M12-2
• Multiple vulnerabilities in Fujitsu M12-1
• Multiple vulnerabilities in Fujitsu M10-4S
• Multiple vulnerabilities in Fujitsu M10-4
• Multiple vulnerabilities in Fujitsu M10-1
• openEuler update for openldap
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Dell PowerStore X