Dear Xihe (Halo) Database Users: Hello. We greatly appreciate your continued support and trust in the Xihe (Halo) database. To continuously improve product security and stability, we recently conducted a comprehensive security audit of the Xihe (Halo) database and discovered the following two important security vulnerabilities. To ensure your data security, we have urgently developed corresponding patches and fixed these vulnerabilities. The details are announced as follows:
I. Vulnerability Details
(I) Privilege Escalation Vulnerability (Execute arbitrary SQL code with administrator privileges)
ID: CVE-2025-1094
Risk Level: High
Vulnerability Description: Escape functions such as PQescapeLiteral() and PQescapeIdentifier() in the libpq library have quote syntax handling defects, which may lead to SQL injection attacks in the following scenarios:
Interactive Terminal Injection: When an application directly concatenates escaped results as psql command parameters, attackers can construct malicious input to tamper with SQL logic.
Encoding Compatibility Vulnerability: When the client encoding is BIG5 and the server is EUC_TW or MULE_INTERNAL, abnormal command line parameter parsing may cause injection.
Remediation Measures: Optimize the quote handling logic of escape functions, add multi-level encoding compatibility verification. Enhance the parsing strictness of psql command line parameters, prohibiting concatenation of unverified external input.
(II) Permission Checking Mechanism Vulnerability (Execute arbitrary SQL code with superuser privileges)
ID: CVE-2024-10976
Risk Level: High
Vulnerability Description: Tables with RLS policies enabled may fail under specific conditions: When query plans are cached and reused (such as connection pools or prepared statements), RLS policies are not correctly bound to the query context. Attackers can exploit cached plans to initiate unauthorized queries, accessing or tampering with unauthorized data rows.
Remediation Measures: Restructure the query plan caching mechanism, forcing deep binding of RLS policies with the query context. Disable plan caching for RLS tables by default, add force_rls_rebind parameter for user manual control.
II. Patch Update
To fix the above vulnerabilities, we have released critical patches for the Xihe (Halo) database. If you have version update requirements, please contact our business team. Our business team will coordinate with technical colleagues to provide you with professional technical support and solutions.
III. Security Recommendations
To ensure your data security, we recommend taking the following security measures:
- Regular Updates: Please regularly follow the Xihe (Halo) database update announcements and promptly apply the latest patches and version updates.
- Permission Management: Please strengthen the permission management of the database system, follow the principle of least privilege, ensuring only users with appropriate permissions can access and operate the database.
- Security Audit: Please regularly conduct security audits and vulnerability scans of the database system to promptly discover and fix potential security issues.
- Use Encrypted Communication: It is recommended to use SSL/TLS encrypted communication between clients and servers to ensure data transmission security.
Thank you again for your support and trust in the Xihe (Halo) database. We will continue to strive to improve product security and stability, providing you with better quality services. If you have any questions during use or need further technical support, please feel free to contact us.