PT-2022-16482 · Timescale+1 · Timescaledb+1

Pedro Gallegos · Published 2022-03-13 · Updated 2025-03-04 · CVE-2022-24128

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TimescaleDB versions 1.x and 2.x before 2.5.2

Description The issue allows privilege escalation during extension installation. An unprivileged user can precreate objects using commands like CREATE which will be used by the installer executing as Superuser. To exploit this, an unprivileged user needs to create objects in a database and then have a Superuser install TimescaleDB into their database.

Recommendations For versions 1.x and 2.x before 2.5.2, update to version 2.5.2 or later to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2025-3660

BIT-TIMESCALEDB-2022-24128

CVE-2022-24128

GHSA-FH8V-663W-79W9

OPENSUSE-SU-2023:0046-1

OPENSUSE-SU-2023:0053-1

Affected Products

Alt Linux

Timescaledb

References · 13

• https://osv.dev/vulnerability/BIT-timescaledb-2022-24128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0046-1 · Vendor Advisory
• https://docs.timescale.com/timescaledb/latest/overview/release-notes · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0053-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24128 · Security Note
• https://github.com/timescale/timescaledb/commit/6275c2985927cfd4900b85cac5120227c8cb1f0c · Note
• https://github.com/timescale/timescaledb/commit/c8b8516e466c2bb7d2ae6a4b0b2e8e60b24b24a2 · Note
• https://github.com/timescale/timescaledb/security/advisories/GHSA-fh8v-663w-79w9 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/WRONJCUCI6J6SG66X575QCEEJ3L4FGTK · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/GV3YAZCCQFFLUXTBUKIOM7YTBZRCAM3A · Note
• https://bugzilla.suse.com/1197063 · Note
• https://suse.com/security/cve/CVE-2022-24128 · Note