CVE-2024-47869
Non-constant-time comparison when comparing hashes in Gradio
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Non-constant-time comparison when comparing hashes in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
Reserved 2024-10-04 | Published 2024-10-10 | Updated 2024-10-11 | Assigner GitHub_MCWE-203: Observable Discrepancy
github.com/...gradio/security/advisories/GHSA-j757-pf57-f8r4
Support options
