CVE-2024-47869

Summary

CVE-2024-47869 is a timing attack vulnerability affecting the Gradio open-source Python package. The issue lies in the comparison method used for the `analytics_dashboard` function, which is not performed in constant time. This allows an attacker to infer the correct hash byte-by-byte by measuring the response time of different requests, potentially leading to unauthorized access to the analytics dashboard. To mitigate this risk, users are advised to upgrade to Gradio version 4.44 or higher. As an interim measure, developers can apply a patch to use a constant-time comparison function or disable access to the analytics dashboard.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.