[Pkg-sogo-maintainers] sogo_5.12.12-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 14 Oct 2026 23:08:12 +0200
Source: sogo
Architecture: source
Version: 5.12.12-1
Distribution: unstable
Urgency: medium
Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers at lists.alioth.debian.org>
Changed-By: Jordi Mallach <jordi at debian.org>
Changes:
 sogo (5.12.12-1) unstable; urgency=medium
 .
   * New upstream release with security bugfixes:
     - IDOR in the contact search endpoint
     - possible header injection through generated Message-Id domains
   * Cherry-pick upstream security fixes from master:
     - session_key_base64_check.patch: possible SQL injection via session key
     - draft_path_traversal.patch: path traversal through draft names
     - bydaymask_buffer_overflow.patch: stack overflow parsing BYDAY rules
     - ldap_filter_escaping.patch: LDAP filter injection
   * Update source lintian overrides for CKEditor 5 and long lines.
   * Do not ship the CKEditor sample page and build files.
   * Drop dependency on obsolete lsb-base.
   * Do not recursively change log and spool directory permissions in postinst.
   * Do not activate the ldconfig trigger for private libraries.
   * Override lintian tags for bundled Material Icons font and CKEditor 5.
   * Add DEP-3 headers to patches missing a description.
   * Drop disable_isIpv4_test.patch, fixed upstream, and refresh the rest.
   * Fix removal of unvendored angular modules, brace expansion needs bash.
   * Override privacy-breach-generic for CKEditor embeds and angular-material docs.
   * Update copyright for CKEditor 5.
   * Move arch-dependent API bundle from sogo-common to sogo.
   * Add missing "New upstream release" entry to previous entry.
   * Document security fixes and CVE ids in previous entries.
Checksums-Sha1:
 acc82ae045c6f5a15c7084191d3df7c7642cec99 2298 sogo_5.12.12-1.dsc
 ac2152a5f910da9d2e3ee9483db7c8cc241fdeaa 38043562 sogo_5.12.12.orig.tar.gz
 3b10e3403090f02069cfaff0704c519c495a47b5 27248 sogo_5.12.12-1.debian.tar.xz
 702a6605e3747c585684d115fec58de36f385540 13627 sogo_5.12.12-1_amd64.buildinfo
Checksums-Sha256:
 93d07504e3df03830911ee11aa80f64c23768363fce0d0bf490f36860860d558 2298 sogo_5.12.12-1.dsc
 afaa47bc018829146ee7caea982c1d55d3e3c71fb4124c10d49ed67c56760517 38043562 sogo_5.12.12.orig.tar.gz
 1d20fba0e90de56fa98bca0a6fa14b797fd8b6efd3acf6b08886ab10108f8ec6 27248 sogo_5.12.12-1.debian.tar.xz
 023d46bb82f04ccfc2849e2e68c46fc12d896863a83c5bd188bc0f31adb9d6a1 13627 sogo_5.12.12-1_amd64.buildinfo
Files:
 a4945706f96c157d29f31243d6d9da6b 2298 mail optional sogo_5.12.12-1.dsc
 4ffb0a2e4a7a4a6b3de56980baf24447 38043562 mail optional sogo_5.12.12.orig.tar.gz
 e1d2e75788b39f302904340aade1c17c 27248 mail optional sogo_5.12.12-1.debian.tar.xz
 857567ccd9737c73a42b6a6e63dea443 13627 mail optional sogo_5.12.12-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE6BdUhsApKYN8KGoWJVAvb8vjywQFAmrP8g8ACgkQJVAvb8vj
ywQw8A/+Ief00mVR+xTpo1RWV1/FVL/ZjCb4Z3aJTICR93evDivls+lI/nhCs+E0
KI6stcF9ehvnsLr43rFjwdkGPgl5p+a619QX2jzSgSXdGbJVsQnh6iWTKltC1qfY
Frj8frWHFHKXzsMYpwljQajXFvr3XKrOr52efdtThDQkXDOXPn0BQGH/SDbEMahK
+T72KjtPjftovM0xaSZTf05NrrdwNUCPeTu3t/p2I45T4XobSAyOWykfPPIVrlP0
rse03a+b7i9gMcNZM48I+AOjIa6XDnzmeNmlNzpUPftwcKAVNl94oE4ouwNczCWR
4Y3jyTcs8m1vHLAH8w2CYgFT/QFTckoLx8A2KpHKOrSLf59YTkBPhFes21HdX6Pg
q7BBW2mJIildm10oXEBVDEsMm4BBbOo69dJf46QXQ2MoMGtyPonNwpoLmI479QPg
7UWc6ISx5EzOKIRZXwM+0ZRRCHUAL5e3iOzkqN034sxtPfH352GRAh4EMQ/QwP4Q
LFv+bM1+1DLbXxKxqrp3p4OeHqHZYZe5NHDrO9Ko0h/+t14S3TUg/cl2a6AEmiKO
TKz9ekntiXymNQqtPOzD9TCDS0N3M38ZM2pHbzhXsZSJTMCFUv9Z0SzRKzCNcnp+
26RzTCRsPA4/OJ1YKRMEP4vaFtOCV/jN1Ounn78+oKoYxroa8SA=
=VMGF
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-sogo-maintainers/attachments/20261014/b249ba76/attachment-0001.sig>