CVE-2024-1729: Gradio apps vulnerable to timing attacks to guess password

# CVE-2024-1729: Gradio apps vulnerable to timing attacks to guess password

https://gcdradar.vercel.app/incidents/cve-2024-1729-gradio-apps-vulnerable-to-timing-attacks-to-gu · AIR-2024-0074 · closed 2024-02-22

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-02-22
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2024-1729
- CVSS: 5.9

## Summary

A timing attack vulnerability exists in Gradio password-protected applications due to early string mismatch termination. An unrated-limited brute-force attack could potentially allow users to guess correct credentials.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-03-29: CVE-2024-1729: A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. (https://nvd.nist.gov/vuln/detail/CVE-2024-1729)
- 2024-02-22: CVE-2024-1729: Gradio apps vulnerable to timing attacks to guess password (https://github.com/advisories/GHSA-hmx6-r76c-85g9)

## Sources

- 2024-02-22 GitHub Advisory Database: CVE-2024-1729: Gradio apps vulnerable to timing attacks to guess password https://github.com/advisories/GHSA-hmx6-r76c-85g9
- 2024-03-29 NVD: CVE-2024-1729: A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. https://nvd.nist.gov/vuln/detail/CVE-2024-1729

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.