Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
References
| Link | Resource |
|---|---|
| https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4 | Third Party Advisory |
Configurations
History
17 Oct 2024, 16:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:* | |
| References | () https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4 - Third Party Advisory | |
| First Time |
Gradio Project
Gradio Project gradio |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.7 |
10 Oct 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-10 23:15
Updated : 2024-10-17 16:59
NVD link : CVE-2024-47869
Mitre link : CVE-2024-47869
JSON object : View
Products Affected
gradio_project
- gradio
CWE
CWE-203
Observable Discrepancy