simplesamlphp - Debian Package Tracker

general

source: simplesamlphp (main)
version: 2.4.8-1
maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
uploaders: Nikolas Nyby [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.19.0-1
o-o-sec: 1.19.0-1+deb11u2
oldstable: 1.19.7-1+deb12u2
old-sec: 1.19.7-1+deb12u1
testing: 2.2.6-1
unstable: 2.4.8-1

versioned links

1.19.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19.0-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19.7-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19.7-1+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

simplesamlphp

action needed

A new upstream version is available: 2.5.3.1 high

A new upstream version 2.5.3.1 is available, you should consider packaging it.

Created: 2026-07-20 Last update: 2026-08-18 12:02

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-49284: SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.

Created: 2026-07-19 Last update: 2026-08-02 20:32

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2024-52596: SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.
CVE-2024-52806: SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Created: 2024-12-02 Last update: 2024-12-03 21:32

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-07-27 Last update: 2026-08-18 12:02

lintian reports 74 warnings normal

Lintian reports 74 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-18 Last update: 2026-08-18 10:48

RFS: A sponsor is needed to update this package. normal

A Debian contributor is looking for a sponsor to upload a package update. It might be the regular maintainer who does not have any upload right yet, or it might be someone who just wants to help for a bugfix or a new upstream version. In any case, if you have upload rights and care about this package and Debian in general, you should look into sponsoring this update. Please see bug number #1144391 for more information.

Created: 2026-08-14 Last update: 2026-08-14 18:32

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.5.3.1-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 5739c079a69e71d4c06bf9e893bcb728c8e27744
Merge: 5f63d43 fb349de
Author: Nikolas Nyby <nikolas@gnu.org>
Date:   Fri Aug 14 10:41:58 2026 -0400

    Merge branch 'update-2.5.3.1' into 'debian/latest'
    
    Update to 2.5.3.1
    
    See merge request php-team/pear/simplesamlphp!18

commit fb349de02de845e5e5d4eb4d94a6b8ec553b3343
Author: Nikolas Nyby <nikolas@gnu.org>
Date:   Fri Aug 14 09:47:00 2026 -0400

    Update to 2.5.3.1

commit 5f63d43a62db7234d8a1e5577308705a32c66ec8
Merge: f98480a 27092f3
Author: Nikolas Nyby <nikolas@gnu.org>
Date:   Fri Aug 14 09:40:52 2026 -0400

    Update upstream source from tag 'upstream/2.5.3.1'
    
    Update to upstream version '2.5.3.1'
    with Debian dir 80bad0741600a101c0d476fc5aa2609d3ffdcebb

commit 27092f339db986cdde52a765a185c4b0b18e1dae
Author: Nikolas Nyby <nikolas@gnu.org>
Date:   Fri Aug 14 09:39:35 2026 -0400

    New upstream version 2.5.3.1

commit b0a8ecc511f3b4178a4c9b4387bf65332acc7f7f
Author: Nikolas Nyby <nikolas@gnu.org>
Date:   Mon Jul 20 14:33:33 2026 -0400

    New upstream version 2.4.8

https://salsa.debian.org/api/v4/projects/php-team%2Fpear%2Fsimplesamlphp API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-14 Last update: 2026-08-14 17:04

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2026-07-22 10:31

testing migrations

excuses:
- Migration status for simplesamlphp (2.2.6-1 to 2.4.8-1): Will attempt migration (Any information below is purely informational)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/s/simplesamlphp.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 27 days old (needed 5 days)

news

[rss feed]

[2026-07-21] Accepted simplesamlphp 2.4.8-1 (source) into unstable (Nikolas Nyby) (signed by: Simon Quigley)
[2026-07-20] Accepted simplesamlphp 2.3.11-2 (source) into unstable (Nikolas Nyby) (signed by: bage@debian.org)
[2026-07-14] Accepted simplesamlphp 2.3.11-1 (source) into unstable (Nikolas Nyby) (signed by: Simon Quigley)
[2026-07-09] simplesamlphp 2.2.6-1 MIGRATED to testing (Debian testing watch)
[2026-07-03] Accepted simplesamlphp 2.2.6-1 (source) into unstable (Nikolas Nyby) (signed by: Alexandre Detiste)
[2026-06-20] simplesamlphp 2.1.8-0.1 MIGRATED to testing (Debian testing watch)
[2026-06-15] Accepted simplesamlphp 2.1.8-0.1 (source) into unstable (Nikolas Nyby) (signed by: Alexandre Detiste)
[2025-05-31] Accepted simplesamlphp 1.19.7-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Tobias Frost)
[2025-05-10] Accepted simplesamlphp 1.19.7-2 (source) into unstable (Tobias Frost)
[2025-05-09] Accepted simplesamlphp 1.19.0-1+deb11u2 (source) into oldstable-security (Tobias Frost)
[2025-01-01] simplesamlphp REMOVED from testing (Debian testing watch)
[2024-12-03] Accepted simplesamlphp 1.19.7-1+deb12u1 (source all) into proposed-updates (Debian FTP Masters) (signed by: Thijs Kinkhorst)
[2024-12-02] Accepted simplesamlphp 1.19.7-1+deb12u1 (source all) into stable-security (Debian FTP Masters) (signed by: Thijs Kinkhorst)
[2024-12-01] Accepted simplesamlphp 1.19.0-1+deb11u1 (source all) into oldstable-security (Thijs Kinkhorst)
[2023-01-10] simplesamlphp 1.19.7-1 MIGRATED to testing (Debian testing watch)
[2023-01-04] Accepted simplesamlphp 1.19.7-1 (source) into unstable (Thijs Kinkhorst)
[2022-12-11] simplesamlphp 1.19.6-1 MIGRATED to testing (Debian testing watch)
[2022-12-06] Accepted simplesamlphp 1.19.6-1 (source) into unstable (Thijs Kinkhorst)
[2021-09-17] simplesamlphp 1.19.1-1.1 MIGRATED to testing (Debian testing watch)
[2021-09-11] Accepted simplesamlphp 1.19.1-1.1 (source) into unstable (Paul Gevers)
[2021-05-10] Accepted simplesamlphp 1.19.1-1 (source all) into unstable (Thijs Kinkhorst)
[2021-02-03] simplesamlphp 1.19.0-1 MIGRATED to testing (Debian testing watch)
[2021-01-29] Accepted simplesamlphp 1.19.0-1 (source) into unstable (Thijs Kinkhorst)
[2020-09-09] simplesamlphp 1.18.8-1 MIGRATED to testing (Debian testing watch)
[2020-09-04] Accepted simplesamlphp 1.18.8-1 (source) into unstable (Thijs Kinkhorst)
[2020-05-20] simplesamlphp 1.18.7-1 MIGRATED to testing (Debian testing watch)
[2020-05-15] Accepted simplesamlphp 1.18.7-1 (source) into unstable (Thijs Kinkhorst)
[2020-04-25] simplesamlphp 1.18.6-1 MIGRATED to testing (Debian testing watch)
[2020-04-20] Accepted simplesamlphp 1.18.6-1 (source) into unstable (Thijs Kinkhorst)
[2020-03-25] simplesamlphp 1.18.5-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 74)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
l10n (-, 84)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.4.8-1