Dear Xihe (Halo) Database Users:
Hello. We greatly appreciate your continued support and trust in the Xihe (Halo) database. To continuously improve product security and stability, we recently conducted a comprehensive security audit of the Xihe (Halo) database and discovered the following three important security vulnerabilities.
I. Vulnerability Details
(I) pg_signal_backend Role Privilege Vulnerability
Vulnerability ID: CVE-2023-5870
Risk Level: Low
Vulnerability Description: In certain versions of the Xihe (Halo) database, users with the pg_signal_backend role can send signals to background processes. This may allow remote users with this privilege to launch denial of service attacks against the database.
Remediation Measures: We have restricted the permissions of the pg_signal_backend role, ensuring only users with superuser privileges can send signals to critical background processes.
(II) Integer Overflow Vulnerability When Modifying Arrays
Vulnerability ID: CVE-2023-5869
Risk Level: High
Vulnerability Description: In certain versions of the Xihe (Halo) database, integer overflow checks are missing when modifying arrays. Remote users can provide specially crafted data to cause overflow, thereby executing arbitrary code, such as writing arbitrary data to memory or reading arbitrary data from memory.
Remediation Measures: We have added integer overflow checking mechanisms in the relevant code for array operations, preventing security issues caused by integer overflow.
(III) Data Leakage Vulnerability When Aggregate Functions Handle "unknown" Type
Vulnerability ID: CVE-2023-5868
Risk Level: Medium
Vulnerability Description: In certain versions of the Xihe (Halo) database, when executing certain aggregate functions receiving the "unknown" type, some data in the server memory may be leaked. This may allow remote users to obtain some sensitive data.
Remediation Measures: We have strictly validated the input types of aggregate functions, ensuring no data leakage when handling the "unknown" type.
II. Patch Update and Security Recommendations
Please contact the business team to obtain critical patches, and strengthen permission management and auditing.