[From nobody Sat Oct 17 15:34:42 2026 Received: (at 1142810-close) by bugs.debian.org; 17 Oct 2026 14:34:22 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 104; hammy, 150; neutral, 164; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:35840) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xI5UM-000G83-1n for 1142810-close@bugs.debian.org; Sat, 17 Oct 2026 14:34:22 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xI5UK-008h1F-34 for 1142810-close@bugs.debian.org; Sat, 17 Oct 2026 14:34:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=n4JWiOO6CxNVk6hkT8Lm2zCLATdHpB8+1r7hR8BFA38=; b=Tdarzn7WV1lf/E/1QATs9luXsz E74YD2zWK20J6x1M0ClxIYtesApOejYUopcrPmBLp+aNRenS/1iNgALWDB4a4WO7mZ4XSpW16SrOE ojGL0FydN5rSHUrSDFqs5RytvudYKewAcW33KBzBotavXL3ynHE4lWPz2SN+pYkPazvl0lagosrR/ BE0qEf5WGC42gyE6Vh5RiAlEEs3rvaHNpt2uqBbDu4NVLye2Gy88VxiFn4IKMOy01lao3h9n1et7B fZr3/cq97i8A1NtAwyhQXwpPle3htH11HakDTBPPGMIw5KpoNxRlq+V3bhdhVerSC/vuRJK88C8SP q8boVnzg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xI5UJ-0000000BpSY-38gs; Sat, 17 Oct 2026 14:34:19 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Peter Wienemann <wiene@debian.org> To: 1142810-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: sogo Debian: DAK Debian-Changes: sogo_5.12.1-3+deb13u3_source.changes Debian-Source: sogo Debian-Version: 5.12.1-3+deb13u3 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1142810: fixed in sogo 5.12.1-3+deb13u3 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3687916119827459821==" Message-Id: <E1xI5UJ-0000000BpSY-38gs@fasolo.debian.org> Date: Sat, 17 Oct 2026 14:34:19 +0000 X-CrossAssassin-Score: 2 --===============3687916119827459821== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: sogo Source-Version: 5.12.1-3+deb13u3 Done: Peter Wienemann <wiene@debian.org> We believe that the bug you reported is fixed in the latest version of sogo, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1142810@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Peter Wienemann <wiene@debian.org> (supplier of updated sogo package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 11 Oct 2026 19:27:09 +0200 Source: sogo Architecture: source Version: 5.12.1-3+deb13u3 Distribution: trixie-security Urgency: medium Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian= .org> Changed-By: Peter Wienemann <wiene@debian.org> Closes: 1142810 1148454 Changes: sogo (5.12.1-3+deb13u3) trixie-security; urgency=3Dmedium . * Non-maintainer upload. * Add patch to fix a regression introduced by fix for CVE-2026-33550 (Closes: #1142810) * Add patch to fix shell injection by disabling sendmail * Add patch to fix SQL injection: properly parse MKCOL request * Add patch to fix XSS: escape angularJS directive for description * Add patch to add stripAngular to stringWithoutHTMLInjection calls This is a follow-up change to the XSS fix escaping angularJS directive. * Add patch to fix SSRF: do not transmit og http status to external calend= ar * Add patch to fix CVE-2026-93453: password reset poisoning (Closes: 1148454) * Add patch to fix XSS: use legitimate sorting value * Add patch to fix XSS issues addressed in upstream PR 395 Checksums-Sha1: 34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc 4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712 sogo_5.12.1-3+deb13u3.debian.= tar.xz 189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842 sogo_5.12.1-3+deb13u3_amd64.b= uildinfo Checksums-Sha256: 0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439 sogo_5= .12.1-3+deb13u3.dsc 7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712 sogo_= 5.12.1-3+deb13u3.debian.tar.xz f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842 sogo_= 5.12.1-3+deb13u3_amd64.buildinfo Files: 680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional sogo_5.12.1-3+deb13u3.d= ebian.tar.xz bd83aad074acf70f53613808082d45f7 14842 mail optional sogo_5.12.1-3+deb13u3_a= md64.buildinfo -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2 QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8 n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18 yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb +wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8 1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=3D =3DYPWx -----END PGP SIGNATURE----- --===============3687916119827459821== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatOHawAKCRCb9qggYcy5 IRgoAPwPigYDmzjtY0PLuTWR9103e1Y8n26g7612btFjkYRJDAD/cwxsEikFymNm lRBRxjfaCXCvqZTZ6q6a9IqygR3uhgY= =TVF2 -----END PGP SIGNATURE----- --===============3687916119827459821==-- ]