HQbird2024R Update 11 Detailed What is New

HQbird 2024 R2 — Update 11 Release Notes

Release focus: Security patches for Firebird 2.5, new encryption plugin capabilities, FBDataGuard improvements, and general stability fixes.

Table of Contents

• Security Alerts
  • Firebird 2.5 — Critical Vulnerabilities Fixed
  • Firebird 3.0 / 4.0 / 5.0 — Use Latest Versions
• Firebird 5 — Important Bug Fix
• Encryption Plugin Improvements
• Silent Mode Installation (Windows)
• HQbird FBDataGuard Changes
  • Improvements
  • Access Rights Separation
  • Bug Fixes

Security Alerts

Firebird 2.5 — Critical Vulnerabilities Fixed

⚠️ Action required for all Firebird 2.5 users.

Firebird 2.5 vanilla reached end-of-life in 2019 and no longer receives upstream security updates. IBSurgeon supports changes for corporate users of Firebird 2.5 in HQbird. This release of HQbird Firebird 2.5 backports fixes for several serious vulnerabilities recently discovered and already patched in Firebird 3.0, 4.0, and 5.0.

Recommendation: Upgrade all existing Firebird 2.5 installations to the latest HQbird Firebird 2.5 immediately.

Do not hesitate to contact us to discuss special conditions for old HQbird users and corporate users with large park of 2.5 installations: [email protected].

Firebird 3.0 / 4.0 / 5.0 — Use Latest Versions

The vulnerabilities listed above also affect Firebird 3.0, 4.0, and 5.0. They have been addressed in the following upstream vanilla releases:

• Firebird 3.0.14
• Firebird 4.0.7
• Firebird 5.0.4

For HQbird users, the recommended versions included in this release (2024 R2 Update 11) are:

Firebird 5 — Important Bug Fix

The QA team identified a significant, long-standing bug affecting the optimization of complex queries with many LEFT JOIN clauses. This has been fixed in the Firebird 5 build included in this HQbird release.

🔗 View the fix on GitHub

Encryption Plugin Improvements

KeyHolderStdin support added for Firebird 4.

This capability was previously available only in Firebird 5 (Firebird 3 uses a different mechanism). With this update, Firebird 4 users can now pass encryption passwords via stdin, enabling secure use of command-line tools without saving passwords to disk:

• Tools covered: gfix, gbak, nbackup
• No longer necessary to use KeyHolder.conf password storage, even during development and debugging

Installation

• Vanilla HQbird users: An updated installation script (downloads and installs the encryption plugin on Windows) is available at: 🔗 FirebirdEncryptionPluginInstall on GitHub
• HQbird licensed users: Included directly in the HQbird installer.

Silent Mode Installation (Windows)

Several improvements have been made to the Windows silent installation process to provide a more flexible and configurable installation experience.

HQbird FBDataGuard Changes

Improvements

• Reinitialization defaults: Adjusted default additional parameters for reinitialization.
• Replication configuration generation:
  • Removed all configuration keys with empty values.
  • Removed elements irrelevant to the node's role (parameters that were retained in settings after switching master/replica roles, or after version upgrades from 2/3 → 4/5).
• Database connections: Enforced UTF-8 encoding (restores previously existing behavior).
• Jaybird: Upgraded to version 5.12.
• Connection strings: Fixed generation when working with a custom list of authorization plugins.
• Database registration: Added a uniqueness check and a requirement for the registration name entered for databases.

Access Rights Separation

A new access rights separation mechanism has been implemented for admin and guest users.

Default Guest Credentials (changed)

Guest User Restrictions

The guest user is now restricted from:

• Running on-demand tasks (shows an "Access denied" dialog)
• Performing reinitialization
• Managing trace sessions, speed tests, and password changes

Additional Notes

• Passwords can only be changed by manually editing \HQBirdData\config\access.properties.
• If access.guest-password is left empty, login via the guest account is blocked entirely.
• Uniqueness of admin and guest usernames is not validated.

Bug Fixes

• Fixed several issues in error handling for insufficient filesystem permissions.
• Added additional logging and error notifications in the VSS request handler.
• Adjusted default configurations to match the new default passwords for file transfer tasks (port: 8722 / user: socketuser / strong password).
• Fixed an occasional false-critical notification for databases in the state "all tasks temporarily disabled".

HQbird is developed and maintained by IBSurgeon. For support and documentation, visit ibsurgeon.com.