CVE-2023-2970: A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1

Routine

LOW 3.5DOWNGRADE

CVE-2023-2970 is a low-severity flaw (CVSS 3.5) affecting mindspore. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	3.5 (Low)
Attack vector	Adjacent network
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.9% (top 41%)
CISA exploited list	No
Weakness	CWE-119
Published	2023-05-30
Last modified	2026-06-17

Publisher (CNA): VulDB · Vendor: mindspore

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-05-30 06:16 UTCPublished CVE record published
2026-06-17 05:53 UTCUpdated Record last modified

mindspore mindspore DOWNGRADE

Affected: 2.0.0 alpha · 2.0.0 rc1

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0.0

1. Check installed version

apt-cache policy mindspore || rpm -q mindspore || mindspore --version

2. No fixed release: DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)

apt-cache madison mindspore sudo apt install mindspore=<VERSION_BEFORE_2.0.0> sudo apt-mark hold mindspore

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mindspore sudo dnf downgrade mindspore-<VERSION_BEFORE_2.0.0> sudo dnf versionlock add mindspore

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-2970?

mindspore: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-2970 being exploited?

CVE-2023-2970 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-2970 affect?

CVE-2023-2970 affects mindspore. Severity is low (CVSS 3.5). A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads

How urgent is CVE-2023-2970?

Priority 27/100. No elevated risk signals yet.

Related CVEs

CVE-2021-33654 HIGH 7.5 UPGRADE When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it
CVE-2021-33653 HIGH 7.5 UPGRADE When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the p
CVE-2021-33652 HIGH 7.5 UPGRADE When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes eleme
CVE-2021-33651 HIGH 7.5 UPGRADE When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is
CVE-2021-33650 HIGH 7.5 UPGRADE When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less t

References

← Back to latest CVEs