CVE-2022-29155
CriticalIn OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.
Published May 4, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2022-29155, BIT-openldap-2022-29155, DEBIAN-CVE-2022-29155, DLA-3017-1, DSA-5140-1, JLSEC-2026-174, SUSE-SU-2022:1670-1, SUSE-SU-2022:1671-1, SUSE-SU-2022:1685-1, SUSE-SU-2022:1771-1, SUSE-SU-2022:1832-1, UBUNTU-CVE-2022-29155, USN-5424-1, USN-5424-2
Key Facts
Patch immediately- CVE-2022-29155 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Openldap, Debian Linux, H300s Firmware (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including compat-libldap-2_3-0 2.3.37-42.1, libldap-2_4-2 2.4.41-18.89.1, libldap-2_4-2 2.4.41-22.10.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-29155 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
Affected Products
439 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| OpenldapOpenldap | >= 2.0.0 | 2.5.12 |
| Debian LinuxDebian | 10.0, 11.0, 9.0 | n/a |
| H300s FirmwareNetapp | See advisory | n/a |
| H410c FirmwareNetapp | See advisory | n/a |
| H410s FirmwareNetapp | See advisory | n/a |
Patched Releases
compat-libldap-2_3-0
2.3.37-42.1
libldap-2_4-2
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
libldap-2_4-2-32bit
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
libldap-data
2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
Openldap
2.4.31-1+nmu2ubuntu8.5+esm5, 2.4.42+dfsg-2ubuntu3.13+esm1, 2.4.44+dfsg-5+deb9u9, 2.4.45+dfsg-1ubuntu1.11, 2.4.47+dfsg-3+deb10u7, 2.4.49+dfsg-2ubuntu1.9, 2.4.57-3, 2.4.57-3.ph2, 2.4.57-3.ph3, 2.4.57-3.ph4, 2.4.57-7, 2.4.57+dfsg-3+deb11u1, 2.5.11+dfsg-1~exp1ubuntu3.1, 2.5.12, 2.5.12+dfsg-1, 2.6.2, 2.6.2-1, 2.6.2-r0
openldap-servers-sql
2.4.40-16.32.amzn1, 2.4.44-23.amzn2.0.4
openldap2
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.41-42.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-meta
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-perl
2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-back-sock
2.4.46-150200.14.8.1
openldap2-back-sql
2.4.46-150200.14.8.1
openldap2-client
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-contrib
2.4.46-150200.14.8.1
openldap2-devel
2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-devel-32bit
2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-devel-static
2.4.41-22.10.1, 2.4.46-150000.9.71.1, 2.4.46-150200.14.8.1
openldap2-doc
2.4.41-18.89.1, 2.4.41-22.10.1, 2.4.46-150200.14.8.1
openldap2-ppolicy-check-password
1.2-150000.9.71.1, 1.2-150200.14.8.1, 1.2-18.89.1, 1.2-22.10.1
OpenLDAPClient_jll
2.5.14+0
rootio-openldap
2.4.57+dfsg-3+deb11u1, 2.5.12+dfsg-1
Timeline
Publicly disclosed
May 4, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
- advisoryhttps://bugzilla.suse.com/1191157
- advisoryhttps://bugzilla.suse.com/1197004
- advisoryhttps://bugzilla.suse.com/1198383
- advisoryhttps://bugzilla.suse.com/1199240
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29155.json
FAQ
Common Questions.
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.
Affected: Openldap versions >= 2.0.0; Debian Linux versions 10.0, 11.0, 9.0; H300s Firmware (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including compat-libldap-2_3-0 2.3.37-42.1, libldap-2_4-2 2.4.41-18.89.1, libldap-2_4-2 2.4.41-22.10.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-29155 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo