{
  "cveId": "CVE-2025-61911",
  "url": "https://patchblox.com/security/cve/CVE-2025-61911",
  "summary": "CVE-2025-61911 is fixed in 4 products on 1 platform, first by python-ldap 3.0.0-1ubuntu0.2\u002Besm1, released October 10, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-ldap: python-ldap is a lightweight directory access protocol (LDAP) client APIfor Python",
  "description": "python-ldap is a lightweight directory access protocol (LDAP) client APIfor Python. In versions prior to 3.4.5, the sanitization method\u0060ldap.filter.escape_filter_chars\u0060 can be tricked to skip escaping ofspecial characters when a crafted \u0060list\u0060 or \u0060dict\u0060 is supplied as the\u0060assertion_value\u0060 parameter, and the non-default \u0060escape_mode=1\u0060 isconfigured. The method \u0060ldap.filter.escape_filter_chars\u0060 supports 3different escaping modes. \u0060escape_mode=0\u0060 (default) and \u0060escape_mode=2\u0060happen to raise exceptions when a \u0060list\u0060 or \u0060dict\u0060 object is supplied asthe \u0060assertion_value\u0060 parameter. However, \u0060escape_mode=1\u0060 computes withoutperforming adequate logic to ensure a fully escaped return value. If anapplication relies on the vulnerable method in the \u0060python-ldap\u0060 library toescape untrusted user input, an attacker might be able to abuse thevulnerability to launch ldap injection attacks which could potentiallydisclose or manipulate ldap data meant to be inaccessible to them. Version3.4.5 fixes the issue by adding a type check at the start of the\u0060ldap.filter.escape_filter_chars\u0060 method to raise an exception when thesupplied \u0060assertion_value\u0060 parameter is not of type \u0060str\u0060.",
  "published": "2025-10-10T15:15:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.0032,
  "epssPercentile": 0.25127,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.4.3-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2025-61911",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-61911",
      "released": "2025-10-10T22:15:37Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.4.4-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2025-61911",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-61911",
      "released": "2025-10-10T22:15:37Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "Debian 14",
      "fixedVersion": "3.4.5-1",
      "fix": "DEBIAN-CVE-2025-61911",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-61911",
      "released": "2025-10-10T22:15:37Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.0.0-1ubuntu0.2\u002Besm1",
      "fix": "python-ldap 3.0.0-1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-ldap-3.0.0-1ubuntu0.2-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.4.0-150400.3.3.1",
      "fix": "SUSE-SU-2025:3714-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-3714-1",
      "released": "2025-10-22T07:10:58Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.4.4-160000.3.1",
      "fix": "OPENSUSE-SU-2026:20421-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20421-1",
      "released": "2026-03-25T10:40:32Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "sles 15.6",
      "fixedVersion": "3.4.0-150400.3.3.1",
      "fix": "SUSE-SU-2025:3714-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-3714-1",
      "released": "2025-10-22T07:10:58Z"
    },
    {
      "platform": "linux",
      "product": "python-ldap",
      "release": "sles 16.0",
      "fixedVersion": "3.4.4-160000.3.1",
      "fix": "SUSE-SU-2026:20933-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20933-1",
      "released": "2026-03-25T10:48:13Z"
    },
    {
      "platform": "linux",
      "product": "python-pyldap",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.0.0-1ubuntu0.2\u002Besm1",
      "fix": "python-pyldap 3.0.0-1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-pyldap-3.0.0-1ubuntu0.2-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.0.0-1ubuntu0.2\u002Besm1",
      "fix": "python3-ldap 3.0.0-1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-ldap-3.0.0-1ubuntu0.2-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.2.0-4ubuntu2.1\u002Besm1",
      "fix": "python3-ldap 3.2.0-4ubuntu2.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-ldap-3.2.0-4ubuntu2.1-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.2.0-4ubuntu7.2",
      "fix": "python3-ldap 3.2.0-4ubuntu7.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-ldap-3.2.0-4ubuntu7.2",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.4.4-1ubuntu0.24.04.1",
      "fix": "python3-ldap 3.4.4-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-ldap-3.4.4-1ubuntu0.24.04.1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "3.4.4-1ubuntu0.25.04.1",
      "fix": "python3-ldap 3.4.4-1ubuntu0.25.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-python3-ldap-3.4.4-1ubuntu0.25.04.1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "python3-ldap",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3.4.4-1ubuntu0.25.10.1",
      "fix": "python3-ldap 3.4.4-1ubuntu0.25.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-ldap-3.4.4-1ubuntu0.25.10.1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.0.0-1ubuntu0.2\u002Besm1",
      "fix": "python3-pyldap 3.0.0-1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-pyldap-3.0.0-1ubuntu0.2-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.2.0-4ubuntu2.1\u002Besm1",
      "fix": "python3-pyldap 3.2.0-4ubuntu2.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-pyldap-3.2.0-4ubuntu2.1-esm1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.2.0-4ubuntu7.2",
      "fix": "python3-pyldap 3.2.0-4ubuntu7.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-pyldap-3.2.0-4ubuntu7.2",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.4.4-1ubuntu0.24.04.1",
      "fix": "python3-pyldap 3.4.4-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-pyldap-3.4.4-1ubuntu0.24.04.1",
      "released": "2025-10-10T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "3.4.4-1ubuntu0.25.04.1",
      "fix": "python3-pyldap 3.4.4-1ubuntu0.25.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-python3-pyldap-3.4.4-1ubuntu0.25.04.1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyldap",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3.4.4-1ubuntu0.25.10.1",
      "fix": "python3-pyldap 3.4.4-1ubuntu0.25.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-pyldap-3.4.4-1ubuntu0.25.10.1",
      "released": "2025-10-10T15:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}