How many CVEs have patched __init__?

7 published CVEs changed __init__ in matrix-org/synapse, in 32 distinct patches totalling 383 changed lines, between 2020 and 2023.

What is the latest CVE that changed __init__?

CVE-2023-42453 (Improper validation of receipts allows forged read receipts in matrix synapse), published 2023-09-26, changed lines 40 to 41 of synapse/handlers/receipts.py.

How does __init__ compare to the rest of matrix-org/synapse?

matrix-org/synapse has 29 CVEs with a located fix in total; 7 of them changed __init__.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

__init__ in matrix-org/synapse: Patched by 7 CVEs

Improper validation of receipts allows forged read receipts in matrix synapse

CVE-2023-42453 · synapse/handlers/receipts.py · lines 40–41 · +2 −0

Medium · CVSS 6.3

EPSS 0.8%2023-09-26

Synapse has improper checks for deactivated users during login

CVE-2023-32682 · synapse/appservice/__init__.py · line 89 · +1 −0

Medium · CVSS 5.3

EPSS 0.8%2023-06-06

Synapse has improper checks for deactivated users during login

CVE-2023-32682 · synapse/rest/client/login.py · lines 88–123 · +3 −2 in 2 hunks

Medium · CVSS 5.3

EPSS 0.8%2023-06-06

Path traversal in Matrix Synapse

CVE-2021-41281 · synapse/rest/media/v1/filepath.py · lines 131–170 · +26 −2

High · CVSS 8.7

EPSS 1.6%2021-11-23

Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

CVE-2021-21393 · synapse/groups/attestations.py · lines 69–138 · +8 −4 in 2 hunks

Medium · CVSS 6.0

EPSS 1.6%2021-04-12

Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

CVE-2021-21393 · synapse/groups/groups_server.py · lines 47–375 · +9 −4 in 2 hunks

Medium · CVSS 6.0

EPSS 1.6%2021-04-12

Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

CVE-2021-21393 · synapse/rest/client/v2_alpha/groups.py · lines 62–809 · +72 −48 in 24 hunks

Medium · CVSS 6.0

EPSS 1.6%2021-04-12

Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

CVE-2021-21394 · synapse/groups/attestations.py · lines 69–138 · +8 −4 in 2 hunks

Medium · CVSS 6.0

EPSS 1.5%2021-04-12

Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

CVE-2021-21394 · synapse/groups/groups_server.py · lines 47–375 · +9 −4 in 2 hunks

Medium · CVSS 6.0

EPSS 1.5%2021-04-12

Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

CVE-2021-21394 · synapse/rest/client/v2_alpha/groups.py · lines 62–809 · +72 −48 in 24 hunks

Medium · CVSS 6.0

EPSS 1.5%2021-04-12

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/app/generic_worker.py · line 269 · +0 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/crypto/keyring.py · lines 581–751 · +2 −2 in 2 hunks

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/federation/federation_server.py · line 848 · +0 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/federation/transport/client.py · line 38 · +1 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/handlers/federation.py · line 143 · +1 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/handlers/identity.py · lines 49–55 · +3 −3

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/http/federation/matrix_federation_agent.py · lines 74–106 · +10 −3 in 2 hunks

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/push/httppusher.py · line 103 · +1 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Open redirects on some federation and push requests

CVE-2021-21273 · synapse/rest/media/v1/media_repository.py · line 69 · +1 −1

Medium · CVSS 6.3

EPSS 1.8%2021-02-26

Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

CVE-2020-26891 · synapse/rest/client/v2_alpha/auth.py · lines 60–83 · +14 −10

Medium · CVSS 5.1

EPSS 1.9%2020-10-19

init

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track matrix-org/synapse CVEs