MindSpore vulnerable to memory corruption
A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | mindspore | <= 2.0.0-rc1 | no fix |
References
- https://vuldb.com/?ctiid.230176
- https://vuldb.com/?id.230176
- https://gitee.com/mindspore/mindspore/issues/I73DOS
- https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9
- https://github.com/advisories/GHSA-x67g-47p3-rc7f
- https://nvd.nist.gov/vuln/detail/CVE-2023-2970
- https://gitee.com/mindspore/mindspore
- https://github.com/pypa/advisory-database/tree/main/vulns/mindspore/PYSEC-2023-81.yaml
- CVSS vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-119- Platform
- Python (PyPI)
- Package
mindspore- Disclosed
- 30.05.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2023-81 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-x67g-47p3-rc7f - CC BY 4.0
Vulnerability history: mindspore
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.