Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 556
Alerts This Week
Warning Icon 1 556

Ubuntu 16.04 ESM USN-5424-2 Critical: OpenLDAP SQL Injection Risk

ubuntu
Calendar Grey May 19, 2022
Dist Ubuntu Esm H88
Attention Ubuntu users: OpenLDAP vulnerability alert issued. Instructions for fixing arbitrary database modification risks provided.
OpenLDAP could be made to perform arbitrary modifications to the database.

Summary

OpenLDAP could be made to perform arbitrary modifications to the database.

Software Description:

- openldap: Lightweight Directory Access Protocol

Details:

USN-5424-1 fixed a vulnerability in OpenLDAP. This update provides

the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that OpenLDAP incorrectly handled certain SQL statements

within LDAP queries in the experimental back-sql backend. A remote attacker

could possibly use this issue to perform an SQL injection attack and alter

the database.

Topics%20covered

Topics Covered

security advisory critical risk SQL injection OpenLDAP database attack Ubuntu 16.04

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  slapd                           2.4.42+dfsg-2ubuntu3.13+esm1

Ubuntu 14.04 ESM:
  slapd                           2.4.31-1+nmu2ubuntu8.5+esm5

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5424-1

CVE-2022-29155

Severity
critical
Lowest
Low
Medium
High
Critical

May 19, 2022

Topics%20covered

Topics Covered

security advisory critical risk SQL injection OpenLDAP database attack Ubuntu 16.04

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.