Описание
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
A flaw was found in TimescaleDB. Authenticated attackers with direct data manipulation language (DML) access to a compressed hypertable can exploit an out-of-bounds read vulnerability. By supplying a specially crafted Simple8b selector-11 value, attackers can bypass index validation checks during bulk text dictionary decompression. This can lead to query-result integrity failures, incorrect aggregation output, or cause the backend to crash, resulting in a Denial of Service (DoS).
Отчет
This vulnerability is rated as having an Important severity because authenticated database users with low-privilege write permissions can induce backend crashes, trigger PostgreSQL crash recovery, or silently corrupt aggregation results. While exploitation requires direct table manipulation access to compressed hypertables, it does not require elevated administrative privileges, presenting a high risk to service availability and data integrity. In the Red Hat ecosystem, TimescaleDB is not distributed with core Red Hat Enterprise Linux products, but is packaged in community repositories such as EPEL and Fedora.
Меры по смягчению последствий
To mitigate this issue, restrict database user privileges to the minimum necessary, especially for users who do not require direct DML access to compressed hypertables. Ensure that database users are properly authenticated and authorized to limit the attack surface.
Дополнительная информация
Статус:
7.1 High
CVSS3
Связанные уязвимости
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read before the base of the live offsets array through the VectorAgg single-text hashing strategy, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery depending on build configuration.
ALT-PU-2026-14227: package `postgresql17-timescaledb` update to version 2.29.2-alt1
ALT-PU-2026-14225: package `postgresql16-timescaledb` update to version 2.29.2-alt1
ALT-PU-2026-13998: package `postgresql16-timescaledb` update to version 2.29.2-alt1
7.1 High
CVSS3