CVE-2022-29155: Debian Linux

Critical severity, CVSS 9.8. EPSS: 64.5% chance of exploitation in the next 30 days.

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Openldap Openldap: from 2.0, before 2.5.12 (fixed in 2.5.12); from 2.6.0, before 2.6.2 (fixed in 2.6.2)

Published 2022-05-04. Last modified 2026-06-17.