DuckDB implemented block-based encryption starting with version 1.4.0 but had multiple cryptographic weaknesses: fallback to an insecure RNG (pcg32) for key and IV generation, potential compiler optimization removing memory clearing (memset) calls leaving sensitive data in memory, downgrade attacks from GCM to CTR mode allowing bypass of integrity checks, failure to check return values from OpenSSL's rand_bytes(), and exposure of cryptographic keys via public IVs or memory leaks. These issues could allow attackers to recover encryption keys, circumvent integrity protections, or manipulate the RNG state undetected. The vendor fixed these issues in version 1.4.2 by disabling the insecure RNG fallback, switching to secure MbedTLS memory clearing, enforcing explicit cipher specification disallowing insecure modes like CTR, and adding return code checks.

The vulnerabilities could allow attackers to obtain cryptographic keys by exploiting insecure random number generation or memory clearing flaws, bypass encryption integrity checks by downgrading encryption modes, and potentially influence the RNG state without detection. This compromises the confidentiality and integrity of encrypted database files and temporary files. However, no known exploits are reported in the wild.

A patch is available and should be applied. DuckDB version 1.4.2 disables the insecure RNG fallback, uses secure memory clearing methods, requires explicit cipher specification excluding insecure modes like CTR, and checks return codes from cryptographic functions. Users should upgrade to version 1.4.2 or later to mitigate these vulnerabilities.