Privilege Escalation Vulnerability in TimescaleDB by Timescale

CVE-2022-24128

What is CVE-2022-24128?

TimescaleDB versions 1.x and 2.x prior to 2.5.2 have a vulnerability that permits privilege escalation during the extension installation process. An unprivileged user can exploit this issue by creating pre-defined objects in the database which are then utilized by a Superuser during installation. If an unprivileged user successfully creates these objects, they can potentially escalate their privileges when a Superuser installs TimescaleDB into the database. The issue is mitigated in the fixed versions where installation will abort if existing objects are detected.

References