Debian Package Tracker
Register | Log in
Subscribe

php-twig

Flexible, fast, and secure template engine for PHP

Choose email to subscribe with

general
  • source: php-twig (main)
  • version: 3.20.0-2
  • maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
  • uploaders: David Prévot [DMD] – Daniel Beyer [DMD]
  • arch: all
  • std-ver: 4.7.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 2.14.3-1+deb11u2
  • old-sec: 2.14.3-1+deb11u3
  • old-bpo: 3.5.1-1~bpo11+1
  • stable: 3.5.1-1+deb12u1
  • stable-sec: 3.5.1-1+deb12u1
  • testing: 3.20.0-2
  • unstable: 3.20.0-2
  • exp: 3.21.1-1
versioned links
  • 2.14.3-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.14.3-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.5.1-1~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.5.1-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.20.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.21.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • php-twig
  • php-twig-cache-extra
  • php-twig-cssinliner-extra
  • php-twig-doc
  • php-twig-extra-bundle
  • php-twig-html-extra
  • php-twig-inky-extra
  • php-twig-intl-extra
  • php-twig-markdown-extra
  • php-twig-string-extra
action needed
A new upstream version is available: 3.21.1 high
A new upstream version 3.21.1 is available, you should consider packaging it.
Created: 2025-05-06 Last update: 2025-05-09 19:02
3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:
  • CVE-2025-24374: Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
1 issue postponed or untriaged:
  • CVE-2024-51754: (postponed; to be fixed through a stable update) Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
1 ignored issue:
  • CVE-2024-51755: Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
Created: 2025-01-30 Last update: 2025-04-11 01:25
lintian reports 1 error and 4 warnings high
Lintian reports 1 error and 4 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-01-30 Last update: 2025-02-20 04:31
3 low-priority security issues in bookworm low

There are 3 open security issues in bookworm.

3 issues left for the package maintainer to handle:
  • CVE-2024-51754: (needs triaging) Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
  • CVE-2024-51755: (needs triaging) Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
  • CVE-2025-24374: (needs triaging) Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-11-07 Last update: 2025-04-11 01:25
debian/patches: 8 patches to forward upstream low

Among the 8 debian patches available in version 3.20.0-2 of the package, we noticed the following issues:

  • 8 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-02-19 18:01
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).
Created: 2025-02-21 Last update: 2025-02-27 13:25
news
[rss feed]
  • [2025-05-03] Accepted php-twig 3.21.1-1 (source all) into experimental (David Prévot)
  • [2025-02-23] php-twig 3.20.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-02-19] Accepted php-twig 3.20.0-2 (source) into unstable (David Prévot)
  • [2025-02-19] php-twig 3.20.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-02-16] Accepted php-twig 3.20.0-1 (source) into unstable (David Prévot)
  • [2025-02-15] Accepted php-twig 3.20.0-1~bootstrap (source all) into unstable (David Prévot)
  • [2025-02-01] php-twig 3.19.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-01-30] Accepted php-twig 3.19.0-1 (source) into unstable (David Prévot)
  • [2025-01-29] Accepted php-twig 3.19.0-1~bootstrap (source all) into unstable (David Prévot)
  • [2025-01-22] php-twig 3.18.0-7 MIGRATED to testing (Debian testing watch)
  • [2025-01-15] Accepted php-twig 3.18.0-7 (source) into unstable (David Prévot)
  • [2025-01-13] Accepted php-twig 3.18.0-6 (source) into unstable (David Prévot)
  • [2025-01-13] Accepted php-twig 3.18.0-5 (source all) into unstable (David Prévot)
  • [2025-01-12] Accepted php-twig 3.18.0-4 (source) into unstable (David Prévot)
  • [2025-01-06] php-twig 3.18.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-01-01] Accepted php-twig 3.18.0-2 (source) into unstable (David Prévot)
  • [2025-01-01] Accepted php-twig 3.18.0-1 (source all) into unstable (David Prévot)
  • [2025-01-01] php-twig 3.17.1-2 MIGRATED to testing (Debian testing watch)
  • [2024-12-19] Accepted php-twig 3.17.1-2 (source) into unstable (David Prévot)
  • [2024-12-19] Accepted php-twig 3.17.1-1 (source all) into unstable (David Prévot)
  • [2024-11-27] Accepted php-twig 3.15.0-2 (source) into unstable (David Prévot)
  • [2024-11-27] Accepted php-twig 3.15.0-1 (source all) into unstable (David Prévot)
  • [2024-11-20] php-twig 3.14.2-3 MIGRATED to testing (Debian testing watch)
  • [2024-11-17] Accepted php-twig 3.14.2-3 (source) into unstable (David Prévot)
  • [2024-11-10] php-twig 3.14.2-2 MIGRATED to testing (Debian testing watch)
  • [2024-11-08] Accepted php-twig 3.14.2-2 (source) into unstable (David Prévot)
  • [2024-11-08] Accepted php-twig 3.14.2-1 (source all) into unstable (David Prévot)
  • [2024-10-15] php-twig 3.14.0-4 MIGRATED to testing (Debian testing watch)
  • [2024-10-13] Accepted php-twig 3.14.0-4 (source) into unstable (David Prévot)
  • [2024-10-10] Accepted php-twig 3.14.0-3 (source) into unstable (David Prévot)
  • 1
  • 2
bugs [bug history graph]
  • all: 1
  • RC: 0
  • I&N: 1
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (1, 4)
  • buildd: logs, exp, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 3.20.0-2ubuntu1
  • 2 bugs (1 patch)
  • patches for 3.20.0-2ubuntu1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing