Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure…
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. Details During a pentest, a security researcher was able to access environment variable data and other system data by using the sniffcsv function, even though we set enableexternalaccess to false. PoC Impact Provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. For example select from readcsv('/proc/self/environ') fails with a permission error. There seems to be two vectors to this vulnerability: 1. Access to files that should otherwise not be allowed. (We expect Permission Error: Scanning CSV files is disabled through configuration and not to provide any access to the file or even acknowledge that it exists). 2. The content from a (non-csv?) file can be read (e.g. /etc/hosts, proc/self/environ, etc) even though that doesn't seem to be the intent of the sniffcsv function (my understanding…
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
Recommended action: Upgrade to 0.9.3.dev6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.