CVE-2022-24128

Name of the Vulnerable Software and Affected Versions TimescaleDB versions 1.x and 2.x before 2.5.2

Description The issue allows privilege escalation during extension installation. An unprivileged user can precreate objects using commands like CREATE which will be used by the installer executing as Superuser. To exploit this, an unprivileged user needs to create objects in a database and then have a Superuser install TimescaleDB into their database.

Recommendations For versions 1.x and 2.x before 2.5.2, update to version 2.5.2 or later to resolve the issue.