Debian Package Tracker
Register | Log in
Subscribe

php-phpseclib

implementations of an arbitrary-precision integer arithmetic library

Choose email to subscribe with

general
  • source: php-phpseclib (main)
  • version: 2.0.55-1
  • maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
  • uploaders: David Prévot [DMD]
  • arch: all
  • std-ver: 4.7.4
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 2.0.30-2+deb11u2
  • o-o-sec: 2.0.30-2+deb11u3
  • oldstable: 2.0.42-1+deb12u5
  • old-sec: 2.0.42-1+deb12u3
  • stable: 2.0.48-3+deb13u3
  • stable-sec: 2.0.48-3+deb13u1
  • testing: 2.0.55-1
  • unstable: 2.0.55-1
versioned links
  • 2.0.30-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.30-2+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.42-1+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.42-1+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.48-3+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.48-3+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.0.55-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • php-phpseclib
action needed
Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high
vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: unable to access 'https://salsa.debian.org/php-team/pear/phpseclib.git/': The requested URL returned error: 503
Created: 2026-07-24 Last update: 2026-07-24 22:19
1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:
  • CVE-2023-52892: In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.
Created: 2024-06-28 Last update: 2024-06-29 13:15
1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:
  • CVE-2026-55599: (needs triaging) phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-06-23 Last update: 2026-07-18 11:01
1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:
  • CVE-2026-55599: (postponed; to be fixed through a stable update) phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-06-23 Last update: 2026-07-18 11:01
debian/patches: 10 patches to forward upstream low

Among the 11 debian patches available in version 2.0.55-1 of the package, we noticed the following issues:

  • 10 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2026-06-16 10:32
news
[rss feed]
  • [2026-07-04] Accepted php-phpseclib 2.0.30-2+deb11u3 (source) into oldoldstable-security (Utkarsh Gupta)
  • [2026-06-18] php-phpseclib 2.0.55-1 MIGRATED to testing (Debian testing watch)
  • [2026-06-15] Accepted php-phpseclib 2.0.55-1 (source) into unstable (David Prévot)
  • [2026-05-28] php-phpseclib 2.0.54-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-11] php-phpseclib REMOVED from testing (Debian testing watch)
  • [2026-05-04] Accepted php-phpseclib 2.0.42-1+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: David Prévot)
  • [2026-05-04] Accepted php-phpseclib 2.0.48-3+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: David Prévot)
  • [2026-05-02] php-phpseclib 2.0.54-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-28] Accepted php-phpseclib 2.0.54-1 (source) into unstable (David Prévot)
  • [2026-04-14] php-phpseclib 2.0.53-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-12] Accepted php-phpseclib 2.0.53-1 (source) into unstable (David Prévot)
  • [2026-04-02] Accepted php-phpseclib 2.0.48-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: David Prévot)
  • [2026-04-02] Accepted php-phpseclib 2.0.42-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: David Prévot)
  • [2026-03-29] Accepted php-phpseclib 2.0.42-1+deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: David Prévot)
  • [2026-03-29] Accepted php-phpseclib 2.0.48-3+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: David Prévot)
  • [2026-03-26] php-phpseclib 2.0.52-1 MIGRATED to testing (Debian testing watch)
  • [2026-03-23] Accepted php-phpseclib 2.0.52-1 (source) into unstable (David Prévot)
  • [2026-01-30] php-phpseclib 2.0.51-1 MIGRATED to testing (Debian testing watch)
  • [2026-01-27] Accepted php-phpseclib 2.0.51-1 (source) into unstable (David Prévot)
  • [2025-12-18] php-phpseclib 2.0.50-1 MIGRATED to testing (Debian testing watch)
  • [2025-12-16] Accepted php-phpseclib 2.0.50-1 (source) into unstable (David Prévot)
  • [2025-10-09] php-phpseclib 2.0.49-1 MIGRATED to testing (Debian testing watch)
  • [2025-10-07] Accepted php-phpseclib 2.0.49-1 (source) into unstable (David Prévot)
  • [2025-02-19] php-phpseclib 2.0.48-3 MIGRATED to testing (Debian testing watch)
  • [2025-02-17] Accepted php-phpseclib 2.0.48-3 (source) into unstable (David Prévot)
  • [2025-01-09] php-phpseclib 2.0.48-2 MIGRATED to testing (Debian testing watch)
  • [2025-01-05] Accepted php-phpseclib 2.0.48-2 (source) into unstable (David Prévot)
  • [2024-12-29] php-phpseclib 2.0.48-1 MIGRATED to testing (Debian testing watch)
  • [2024-12-26] Accepted php-phpseclib 2.0.48-1 (source) into unstable (David Prévot)
  • [2024-10-13] php-phpseclib 2.0.47-3 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 2.0.55-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing