-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Architecture: source
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc
 4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
 189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Checksums-Sha256:
 0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439 sogo_5.12.1-3+deb13u3.dsc
 7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
 f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Files:
 680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc
 ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional sogo_5.12.1-3+deb13u3.debian.tar.xz
 bd83aad074acf70f53613808082d45f7 14842 mail optional sogo_5.12.1-3+deb13u3_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2
QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF
LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS
YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a
hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr
WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh
rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs
aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR
wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8
n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18
yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb
+wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8
1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=
=YPWx
-----END PGP SIGNATURE-----