-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: i386
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 a74b5980eacdf19538e818e5014828e0847d1d74 103144 sogo-activesync-dbgsym_5.12.1-3+deb13u3_i386.deb
 ffc1e649557ccbff44060bd92811bd916d100fe6 218380 sogo-activesync_5.12.1-3+deb13u3_i386.deb
 aed8e2b2cc4e905fdde1895c0495cbfa3d98149c 1182520 sogo-dbgsym_5.12.1-3+deb13u3_i386.deb
 c12acf730bd8411f0ec00d1c9fcf5a0f2704c4d6 13971 sogo_5.12.1-3+deb13u3_i386-buildd.buildinfo
 416c3577db1af299ccdef9690dc23651496f7204 1178440 sogo_5.12.1-3+deb13u3_i386.deb
Checksums-Sha256:
 003691e4e5cfd77090bf98d6311460b5a99065c2d9e89a6e81da98254272ff94 103144 sogo-activesync-dbgsym_5.12.1-3+deb13u3_i386.deb
 5af527a3137c0bb8d8390e296b54eef75cc21dceaa5a15b73b87988f92e78048 218380 sogo-activesync_5.12.1-3+deb13u3_i386.deb
 9d9488ca149858b1dcabfe46d5a4dc6b82b1c6529e7d887883f21b6429ab9c51 1182520 sogo-dbgsym_5.12.1-3+deb13u3_i386.deb
 dd8ea0dbc84c2fe11cd61c3642211bcfb66c24ebdb6af111c449e34ba13dcc56 13971 sogo_5.12.1-3+deb13u3_i386-buildd.buildinfo
 607185a9a47945ec3d9b5f6e6662fad194e807e079c1d6d43d64e12aa2ac5910 1178440 sogo_5.12.1-3+deb13u3_i386.deb
Files:
 d36e551f93e53a4124867105d6e2dff0 103144 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_i386.deb
 ebd286a3d604e5419cc20b223d3126c4 218380 mail optional sogo-activesync_5.12.1-3+deb13u3_i386.deb
 20d9ad3288116e19ab57b134ea9ee6b1 1182520 debug optional sogo-dbgsym_5.12.1-3+deb13u3_i386.deb
 e0f30447fcae9e7c2d7bb4fa414fdf90 13971 mail optional sogo_5.12.1-3+deb13u3_i386-buildd.buildinfo
 8856491bf99691a6be7fb9dcd43ae82f 1178440 mail optional sogo_5.12.1-3+deb13u3_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmrPDJwACgkQYg9P9sm2
dfHCrA//YxuHZS2u1TdtnbDfwrrpCb7bbeO9m+paIg+DjUAn4tqMX4E+vVrpKJCP
zCGmaoHCcrxVaRqK4jIneDb6m7b9HFxzgIHlNSzaNfeOGZl+2VuxasbXJ1NI53tI
tCRYcKRKQ5hFBueOg50KYFxa3InRdR9ZktYNq5xqu1TbStBlHJZRH+8e8rSZPw//
TimvrHr0hAkFFeYhi3hTvk46Xra/9wrxhfmslgPhf8ypaFNDwpOK1iAWep+cCr6x
uxTX1nNpx2qc4+61MAAbSYSPKs1mD9rW7rGdBYD05474NI9sGBTjzBSP/Z1E5LN5
iJlDMMQfX88X3d9yLNpqublGwZNqSnIUfU34c9ttK1AL7d0Q8Qjh78LhKcT1NDRf
0ruz9fP0gqoZ7YMShg1h86S/Dir/bjiOgFN9CDemChHXnTdXxcDvGmlkwj/y9M6L
TYlEjrenjDZ7X0Os2YwdrFSpo0aOui7CRA1QzYEPUSxHcBMOfOs/j8D8B0SEQU/K
KrfiMtIf9d9p4+BcU+fL+d4+vv7LyAh7+NWSpYohSVRS/DmbYx/R3pIRt/x73KE7
p6xHA/WrzjT1B9KQMtxfFdFP/z6gHY5Z38Ryi1CUei+p2SjnTBzF7hX5dBRNDau6
bk3DxVraooyvM7CvAnW2zwViCXFZ1a12atmCqC3e3dMI49zJwqw=
=3KME
-----END PGP SIGNATURE-----