-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: amd64
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 b8f3ce5e4fdc8603e39082af149c624cddf00929 104668 sogo-activesync-dbgsym_5.12.1-3+deb13u3_amd64.deb
 bb5ae6ecb971485deab7706ecb2af373430efc32 253068 sogo-activesync_5.12.1-3+deb13u3_amd64.deb
 6c64c11db2fa550c1d3662ca1ea755289f0f4bde 1210636 sogo-dbgsym_5.12.1-3+deb13u3_amd64.deb
 2cccedb07fde3bfd252965d48aecb624ef845402 14111 sogo_5.12.1-3+deb13u3_amd64-buildd.buildinfo
 e29cf7acf0976c9dbc1467a23c37aa1ef357b043 1470080 sogo_5.12.1-3+deb13u3_amd64.deb
Checksums-Sha256:
 07e921537eaf1e691f0de2b9db5df31a6af788b82e33054b86e876bbd0c40f64 104668 sogo-activesync-dbgsym_5.12.1-3+deb13u3_amd64.deb
 70c2d855969c39ee0d9ab5a9d4dcf77881e06f2d161b9a96989e1bc9c8c8f83d 253068 sogo-activesync_5.12.1-3+deb13u3_amd64.deb
 6470307c8ad2b4c6782121341ebebcbdc4f70b1cf46c02b5a8fd6d491494d174 1210636 sogo-dbgsym_5.12.1-3+deb13u3_amd64.deb
 b746907f26b53e4b93e3e52e43a787c26d5212d5e76a319ca7dbfc7c3f33a423 14111 sogo_5.12.1-3+deb13u3_amd64-buildd.buildinfo
 a0c9db9036ca7c53b7dabd393c12e47f0a5571bd0ffed18f12c6828b6b0433e8 1470080 sogo_5.12.1-3+deb13u3_amd64.deb
Files:
 668d49442b963924102f49cd721b7432 104668 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_amd64.deb
 dbe79070373f0f3ade7e990c3b131b17 253068 mail optional sogo-activesync_5.12.1-3+deb13u3_amd64.deb
 c9a52cb31acaaca8f6f471b7d9fa6160 1210636 debug optional sogo-dbgsym_5.12.1-3+deb13u3_amd64.deb
 867f57f8752e64ce86e287469c665ae5 14111 mail optional sogo_5.12.1-3+deb13u3_amd64-buildd.buildinfo
 02d97db45d58c1f0ceaa042914b61dbc 1470080 mail optional sogo_5.12.1-3+deb13u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmrPDHsACgkQPkCWRKsh
20fuPBAAmkFBAn/6/vZnPm0zYDVo5n5sg8iNuFVdJ3WHAvPc7sp8mtCC9BCdZ8WL
v979hIZCUExf5Q0ykES8NjLbhf5L7fICeRFoNNZLa8+ANYbkM4vJBrDZ0MaG00bQ
Q5S8hSytqmU60Xr/WmQcWIZIo4wUjVgnYnEHi1OaMVaTyLJlyAmEQpk7iNpDKJ4L
8gnhAredAmk4WQe/fWapX9l5TEn3trWdlru0yuPDNHJ5SE88g749WQK9jXdwyh6D
/WjnVlLzeb676vWtT3TRiZxDjXPYkiN/tw7wRlISvgyEnVebe4C9FqCwbBmz9hm0
he8FrZ1t7zyIHrOHOp2q3sZ4kmFeLiHWPrMc01+JYUciinSwDOeLxujDuiee+iSi
sD9RvSpbL+AfeBkOvfLpE/eWcp4vvq+pcBKoDOg/f6619Mq6vI3frPq3/tEyJjA6
/1GvgBZDgAKEXvJQvCD5pF933Cb4+/m7Stm/qlTiEfrzYpok0SVzj0mgcb3So67D
agqke8OkZi86+qlbvRaOYelbAg3SupUt9/kcVq/ovLmkhR37bP7/3cPmZ6T3fjF0
DVdfC/QBKWIxFsf6gsOw3bn0g9BGT4zPPaSJ6w59dY90XU+r6ExqEt6BBrAwt8xR
1r1xiqPk5PRQ3AxpWRFd1QhBrX3oMA1/+AxVXw3fIj2IhwSHXBc=
=zbNd
-----END PGP SIGNATURE-----