CVE-2023-2970: MindSpore vulnerable to memory corruption
(updated )
A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.
References
- gitee.com/mindspore/mindspore
- gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9
- gitee.com/mindspore/mindspore/issues/I73DOS
- github.com/advisories/GHSA-x67g-47p3-rc7f
- github.com/pypa/advisory-database/tree/main/vulns/mindspore/PYSEC-2023-81.yaml
- nvd.nist.gov/vuln/detail/CVE-2023-2970
- vuldb.com/?ctiid.230176
- vuldb.com/?id.230176
Code Behaviors & Features
Detect and mitigate CVE-2023-2970 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →