Lucene search

K
osvGoogleOSV:BIT-OPENLDAP-2022-29155
HistoryMar 06, 2024 - 10:59 a.m.

BIT-openldap-2022-29155

2024-03-0610:59:57
Google
osv.dev
4
openldap
sql injection
back-sql
slapd
ldap
search filter
escaping

0.011 Low

EPSS

Percentile

84.4%

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.