libauthen-sasl-perl - Debian Package Tracker

general

source: libauthen-sasl-perl (main)
version: 2.2000-2
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: Ansgar Burchardt (DMD)
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.1600-1.1
oldstable: 2.1600-3
stable: 2.1700-1
testing: 2.2000-2
unstable: 2.2000-2

versioned links

2.1600-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1600-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1700-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2000-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libauthen-sasl-perl (2 bugs: 0, 1, 1, 0)

action needed

A new upstream version is available: 2.2100 high

A new upstream version 2.2100 is available, you should consider packaging it.

Created: 2026-10-24 Last update: 2026-11-12 19:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.2000-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit a61cfc24dc80e17500c8a4dc269ce408e1c7db90
Author: gregor herrmann <gregoa@debian.org>
Date:   Sat Nov 7 20:14:06 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit f1697f294c42ae0f1e5ce618e035e67c46d1d800
Author: gregor herrmann <gregoa@debian.org>
Date:   Sat Nov 7 20:14:06 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-07 Last update: 2026-11-07 20:34

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-07 Last update: 2026-09-07 16:30

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2025-40918: (needs triaging) Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. According to RFC 2831, The cnonce-value is an opaque quoted string value provided by the client and used by both client and server to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation depends on a good choice. It is RECOMMENDED that it contain at least 64 bits of entropy.
CVE-2026-86219: (needs triaging) Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-07-16 Last update: 2026-09-19 17:31

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 2.2000-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-09-07 Last update: 2026-09-07 07:34

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-09-06 22:33

news

[rss feed]

[2026-09-12] libauthen-sasl-perl 2.2000-2 MIGRATED to testing (Debian testing watch)
[2026-09-06] Accepted libauthen-sasl-perl 2.2000-2 (source) into unstable (Salvatore Bonaccorso)
[2026-02-03] libauthen-sasl-perl 2.2000-1 MIGRATED to testing (Debian testing watch)
[2026-02-01] Accepted libauthen-sasl-perl 2.2000-1 (source) into unstable (gregor herrmann)
[2025-08-18] libauthen-sasl-perl 2.1900-1 MIGRATED to testing (Debian testing watch)
[2025-08-10] Accepted libauthen-sasl-perl 2.1900-1 (source) into unstable (Salvatore Bonaccorso)
[2025-08-10] Accepted libauthen-sasl-perl 2.1800-1 (source) into unstable (gregor herrmann)
[2023-10-27] libauthen-sasl-perl 2.1700-1 MIGRATED to testing (Debian testing watch)
[2023-09-24] Accepted libauthen-sasl-perl 2.1700-1 (source) into unstable (gregor herrmann)
[2022-10-16] libauthen-sasl-perl 2.1600-3 MIGRATED to testing (Debian testing watch)
[2022-10-13] Accepted libauthen-sasl-perl 2.1600-3 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2022-06-11] libauthen-sasl-perl 2.1600-2 MIGRATED to testing (Debian testing watch)
[2022-06-08] Accepted libauthen-sasl-perl 2.1600-2 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2020-12-24] libauthen-sasl-perl 2.1600-1.1 MIGRATED to testing (Debian testing watch)
[2020-12-18] Accepted libauthen-sasl-perl 2.1600-1.1 (source) into unstable (Holger Levsen)
[2014-03-21] libauthen-sasl-perl 2.1600-1 MIGRATED to testing (Debian testing watch)
[2014-03-10] Accepted libauthen-sasl-perl 2.1600-1 (source all) (Daniel Lintott) (signed by: gregor herrmann)
[2010-06-17] libauthen-sasl-perl 2.1500-1 MIGRATED to testing (Debian testing watch)
[2010-06-06] Accepted libauthen-sasl-perl 2.1500-1 (source all) (Ansgar Burchardt) (signed by: Chris Butler)
[2010-04-04] libauthen-sasl-perl 2.14-1 MIGRATED to testing (Debian testing watch)
[2010-03-17] Accepted libauthen-sasl-perl 2.14-1 (source all) (Franck Joncourt)
[2009-10-08] libauthen-sasl-perl 2.13-1 MIGRATED to testing (Debian testing watch)
[2009-09-27] Accepted libauthen-sasl-perl 2.13-1 (source all) (Gunnar Wolf) (signed by: Gunnar Eyal Wolf Iszaevich)
[2008-07-12] libauthen-sasl-perl 2.12-1 MIGRATED to testing (Debian testing watch)
[2008-07-01] Accepted libauthen-sasl-perl 2.12-1 (source all) (Gunnar Wolf)
[2008-05-07] libauthen-sasl-perl 2.11-1 MIGRATED to testing (Debian testing watch)
[2008-04-26] Accepted libauthen-sasl-perl 2.11-1 (source all) (AGOSTINI Yves) (signed by: gregor herrmann)
[2008-04-16] libauthen-sasl-perl 2.10-1.1 MIGRATED to testing (Debian testing watch)
[2008-04-05] Accepted libauthen-sasl-perl 2.10-1.1 (source all) (Stephen Gran)
[2006-04-14] libauthen-sasl-perl 2.10-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.2000-2
1 bug