Vulnerability · Published Oct 10, 2024 · Assigned by GitHub_M

CVE-2024-47869Non-constant-time comparison when comparing hashes in Gradio

Low 2.3

In plain English

A low-severity security flaw in gradio from gradio-app. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	gradio	4.44.0	GHSA-j757-pf57-f8r4
PyPI	gradio	4.44.0	PYSEC-2024-199

Affected products (as reported)

Vendor	Product	Versions
gradio-app	gradio	< 4.44

Weakness: CWE-203 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4 x_refsource_CONFIRM