Nixpkgs security tracker
8.8 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
17 packages
- timescaledb-tune
- timescaledb-parallel-copy
- postgresql14Packages.timescaledb
- postgresql15Packages.timescaledb
- postgresql16Packages.timescaledb
- postgresql17Packages.timescaledb
- postgresql18Packages.timescaledb
- postgresqlPackages.timescaledb-apache
- postgresqlPackages.timescaledb_toolkit
- postgresql14Packages.timescaledb-apache
- postgresql15Packages.timescaledb-apache
- postgresql16Packages.timescaledb-apache
- postgresql17Packages.timescaledb-apache
- postgresql18Packages.timescaledb-apache
- postgresql15Packages.timescaledb_toolkit
- postgresql16Packages.timescaledb_toolkit
- postgresql17Packages.timescaledb_toolkit
- @mweinelt accepted
- @mweinelt published on GitHub
TimescaleDB uses untrusted search path during extension upgrade
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.
References
-
https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m x_refsource_CONFIRM
-
https://github.com/timescale/timescaledb/pull/9331 x_refsource_MISC
-
https://github.com/timescale/timescaledb/releases/tag/2.25.2 x_refsource_MISC
Affected products
- ==>= 2.23.0, < 2.25.2
Matching in nixpkgs
pkgs.postgresqlPackages.timescaledb
Scales PostgreSQL for time-series data via automatic partitioning across time and space
Ignored packages (17)
pkgs.timescaledb-tune
Tool for tuning your TimescaleDB for better performance
pkgs.timescaledb-parallel-copy
Bulk, parallel insert of CSV records into PostgreSQL
pkgs.postgresql14Packages.timescaledb
None
pkgs.postgresql15Packages.timescaledb
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql16Packages.timescaledb
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql17Packages.timescaledb
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql18Packages.timescaledb
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresqlPackages.timescaledb-apache
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresqlPackages.timescaledb_toolkit
Provide additional tools to ease all things analytic when using TimescaleDB
pkgs.postgresql14Packages.timescaledb-apache
None
pkgs.postgresql15Packages.timescaledb-apache
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql16Packages.timescaledb-apache
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql17Packages.timescaledb-apache
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql18Packages.timescaledb-apache
Scales PostgreSQL for time-series data via automatic partitioning across time and space
pkgs.postgresql15Packages.timescaledb_toolkit
Provide additional tools to ease all things analytic when using TimescaleDB
pkgs.postgresql16Packages.timescaledb_toolkit
Provide additional tools to ease all things analytic when using TimescaleDB
pkgs.postgresql17Packages.timescaledb_toolkit
Provide additional tools to ease all things analytic when using TimescaleDB
Package maintainers
-
@kirillrdy Kirill Radzikhovskyy <kirillrdy@gmail.com>