I'm uploading a 1.4.0-4 package with just the HMAC security fix so that it can propagate into testing quickly, in advance of the work to move to Shibboleth 2.2. I'm also going to contact the security team about fixes for stable and oldstable. -- Russ Allbery (rra at debian.org) <http://www.eyrie.org/~eagle/>