Threats affecting pkg:brew/harlequin

DuckDB introduced block-based encryption on the filesystem starting with version 1.4.0. Several security issues were found in this implementation, including fallback to an insecure random number generator (pcg32), potential removal of memory clearing calls by the compiler, downgrade attacks from GCM to CTR mode bypassing integrity checks, and failure to verify OpenSSL random number generator return values. These vulnerabilities could allow attackers to compromise cryptographic keys, bypass integrity protections, or influence the random number generator state. Version 1.4.2 addresses these issues by disabling the insecure RNG fallback, using secure memory clearing primitives, enforcing cipher specifications with integrity checks, and verifying return codes.