Timescaledb
Monthly
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Arbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious functions by shadowing built-in PostgreSQL functions through user-writable schemas in the search_path setting during extension upgrades. An attacker with database access can create malicious functions in writable schemas that are invoked instead of legitimate PostgreSQL functions, resulting in code execution with database privileges. No patch is currently available for affected installations.
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Arbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious functions by shadowing built-in PostgreSQL functions through user-writable schemas in the search_path setting during extension upgrades. An attacker with database access can create malicious functions in writable schemas that are invoked instead of legitimate PostgreSQL functions, resulting in code execution with database privileges. No patch is currently available for affected installations.
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.