CVE-2022-24128 Privilege escalation in n/a

What is CVE-2022-24128?

CVE-2022-24128 is a high-severity vulnerability in n/a, published on 13 Mar 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CREATE x IF NOT EXIST that allow an unprivileged user to precreate objects. These objects will be used by the installer (which executes as Superuser), leading to privilege escalation. In order to be able to take advantage of this, an unprivileged user would need to be able to create objects in a database and then get a Superuser to install TimescaleDB into their database. (In the fixed versions, the installation aborts when it finds that an object already exists.)

Weakness: CWE-863

Which versions are affected by CVE-2022-24128?

It affects 1 product.

Products include Timescale Timescaledb.

How do I fix CVE-2022-24128?

Upgrade to a fixed version.

Is CVE-2022-24128 being exploited?

There is no known exploitation of CVE-2022-24128 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade High 8.8
• CVE-2023-25149 TimescaleDB has incorrect access control High 8.8
• CVE-2026-70634 TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator High 7.2
• CVE-2026-70633 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator High 7.1
• CVE-2026-70635 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-9cr2-2mw7-2c7r, GHSA-fh8v-663w-79w9, openSUSE-SU-2023:0046-1, openSUSE-SU-2023:0053-1.