openSUSE Security Update: Security update for timescaledb
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2023:0053-1
Rating:             moderate
References:         #1197063 
Cross-References:   CVE-2022-24128
CVSS scores:
                    CVE-2022-24128 (NVD) : 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected Products:
                    openSUSE Backports SLE-15-SP3
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for timescaledb fixes the following issues:

   timescaledb was updated to version 2.9.3

   - https://github.com/timescale/timescaledb/releases/tag/2.9.3
   - enable postgresql15 build
   - https://github.com/timescale/timescaledb/releases/tag/2.9.2
   - https://github.com/timescale/timescaledb/releases/tag/2.9.1
   - https://github.com/timescale/timescaledb/releases/tag/2.9.0
   - https://github.com/timescale/timescaledb/releases/tag/2.8.1
   - https://github.com/timescale/timescaledb/releases/tag/2.8.0
   - https://github.com/timescale/timescaledb/releases/tag/2.7.1
   - https://github.com/timescale/timescaledb/releases/tag/2.7.2
   - https://github.com/timescale/timescaledb/releases/tag/2.7.0
   - https://github.com/timescale/timescaledb/releases/tag/2.6.1
   - CVE-2022-24128: Fixed privilege escalation during extension installation
     (boo#1197063)
   - https://github.com/timescale/timescaledb/releases/tag/2.6.0
   - https://github.com/timescale/timescaledb/releases/tag/2.5.2
   - https://github.com/timescale/timescaledb/releases/tag/2.5.1
   - switch to %{pg_name}-server-devel
   - https://github.com/timescale/timescaledb/releases/tag/1.7.5
   - https://github.com/timescale/timescaledb/releases/tag/2.0.0
   - https://github.com/timescale/timescaledb/releases/tag/2.0.1
   - https://github.com/timescale/timescaledb/releases/tag/2.0.2
   - https://github.com/timescale/timescaledb/releases/tag/2.1.0
   - https://github.com/timescale/timescaledb/releases/tag/2.1.1
   - https://github.com/timescale/timescaledb/releases/tag/2.2.0
   - https://github.com/timescale/timescaledb/releases/tag/2.2.1
   - https://github.com/timescale/timescaledb/releases/tag/2.3.0
   - https://github.com/timescale/timescaledb/releases/tag/2.3.1
   - https://github.com/timescale/timescaledb/releases/tag/2.4.0
   - https://github.com/timescale/timescaledb/releases/tag/2.4.1
   - https://github.com/timescale/timescaledb/releases/tag/2.4.2
   - https://github.com/timescale/timescaledb/releases/tag/2.5.0
   - enable postgresql14
   - https://github.com/timescale/timescaledb/releases/tag/1.7.2
   - https://github.com/timescale/timescaledb/releases/tag/1.7.3
   - https://github.com/timescale/timescaledb/releases/tag/1.7.4


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP3:

      zypper in -t patch openSUSE-2023-53=1



Package List:

   - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64):

      postgresql12-timescaledb-2.9.3-bp153.2.3.1
      postgresql13-timescaledb-2.9.3-bp153.2.3.1
      postgresql14-timescaledb-2.9.3-bp153.2.3.1
      postgresql15-timescaledb-2.9.3-bp153.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2022-24128.html
   https://bugzilla.suse.com/1197063