-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo-common
Architecture: all
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo-common - Scalable groupware server - common files
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 894b94da7ac924fb0275da12afd15c3a9fbf9bb1 18606856 sogo-common_5.12.1-3+deb13u3_all.deb
 33ad93c734b431f54ff9703eefe37b1d1027c133 13195 sogo_5.12.1-3+deb13u3_all-buildd.buildinfo
Checksums-Sha256:
 9245b34c3c7693b42456962037da2ee717f3f2a179aa2bf81a66e90117e8b299 18606856 sogo-common_5.12.1-3+deb13u3_all.deb
 223d2a27586ea6c4c878855826758c4c6d30cc30ca995c6cb26a384db40e2812 13195 sogo_5.12.1-3+deb13u3_all-buildd.buildinfo
Files:
 e3d79ce0a6729020adce7aaa5b6f3984 18606856 mail optional sogo-common_5.12.1-3+deb13u3_all.deb
 62fc72bc410f8be974be224aaafa1679 13195 mail optional sogo_5.12.1-3+deb13u3_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmrPDJ8ACgkQmgPNRvTf
/zcgthAAjMDkbuyNSrlxOO/X3JkCGgoKDsUNCYQIXUDylZideUAtWhs1tpRtARwj
0DqYeRbhSHwTB/frxpWRT8RE6BlczcXE2uw7ogyA8ehQ9apXkbXfMZRxY2yfZj91
77X8mjLmwW6aKHWSBcXYYmYP1Er7lgiwCUUeTyPiL9/9kdmqUaqFUoasgqlpEoOu
7cWavfGEmfLU31GSGxrdpr7Xc3AX/B4Fd9GPgIAFH8UoRP4IUSXu/Stt/QRPEYAa
DvoXxN/LW/BPpLHqcQY8auHujEqKAMnBCiXaaFKdsbw6rV5Zp5DYZry1ws1Nzr7w
LxsMZFGeOxh463HbQuakyj/WGRmGUhrIt9ffqDYkbTN75jjBTxU/imrphaIt7Hj/
7OWC6Ts+2l67kVOjYC+JAyGhQa/Q23V4x6+sy1OG/l4Z28EXuHqo6x3I788TyoWg
WxSFv58KhAG4I8YoLgUx2diIvpt5JT6YW+srzdSO1oMWnsy8S7VfoySYTJtELFJQ
FsMT7f/m1TLO10pgKuXqi39kdxYZ0cEMNyFZBIG7iF9jhAUlRN45Tgzsdx39CXkJ
4koHheq/bdx3RTT19OZ3wosO/WuqoQcI8q7xDwmXLBdAFCuZphfN4m+jQoFL+WzN
cNrNp7C5qa5Ox2nwDiNdm2xcwAb3LMHQm2h0R2wN3PU5vQB+2z0=
=SQtO
-----END PGP SIGNATURE-----