PatchTheCVEmindspore vulnerabilities and fixes
Recent CVEs affecting mindspore, with upgrade or downgrade steps. 9 tracked.
mindspore has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2023-05-30. Highest priority: CVE-2021-33654 (score 46/100).
- CVE-2023-2970 LOW 3.5 DOWNGRADE A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1
- CVE-2021-33654 HIGH 7.5 UPGRADE When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it
- CVE-2021-33653 HIGH 7.5 UPGRADE When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the p
- CVE-2021-33652 HIGH 7.5 UPGRADE When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes eleme
- CVE-2021-33651 HIGH 7.5 UPGRADE When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is
- CVE-2021-33650 HIGH 7.5 UPGRADE When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less t
- CVE-2021-33649 HIGH 7.5 UPGRADE When performing the inference shape operation of the Transpose operator, if the value in the perm element is g
- CVE-2021-33648 HIGH 7.5 UPGRADE When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gathe
- CVE-2021-33647 HIGH 7.5 UPGRADE When performing the inference shape operation of the Tile operator, if the input data type is not int or int32
FAQ
How do I fix mindspore vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mindspore being exploited right now?
None of the tracked mindspore CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mindspore CVE should I patch first?
CVE-2021-33654 currently ranks highest (46/100): When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it.