-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: armhf
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: armhf Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 58dcd75e0e3faaa57c409ed5e328fa5232286238 107712 sogo-activesync-dbgsym_5.12.1-3+deb13u3_armhf.deb
 b9114076e46db29242dec6b88e1a08f365a7c159 258464 sogo-activesync_5.12.1-3+deb13u3_armhf.deb
 e98b971fe1e64bc74c3308e6ad0b6da05441f8a7 1276892 sogo-dbgsym_5.12.1-3+deb13u3_armhf.deb
 5e41c3b0c061a2f03acac6222bff6b78bf7466a1 13957 sogo_5.12.1-3+deb13u3_armhf-buildd.buildinfo
 1a98596e6a84ccf54a001c066d4c8c4427496745 1350260 sogo_5.12.1-3+deb13u3_armhf.deb
Checksums-Sha256:
 69f6c166cbe3784984051b0e546c62d8b546b672a132a1b9b8143af0d6941d23 107712 sogo-activesync-dbgsym_5.12.1-3+deb13u3_armhf.deb
 e86862707e8b6bf70710a21f2a77a95b6284d4084499044ce539cd69804fce10 258464 sogo-activesync_5.12.1-3+deb13u3_armhf.deb
 d8a6fbf98cf2fe833a7f077da3e40d77e2cbb4b1bfa16965925c96e81dbd8687 1276892 sogo-dbgsym_5.12.1-3+deb13u3_armhf.deb
 7efdf64c77eefde89c3628f68fcc4730f84613c40c2d41e6fb662f08ff00b97f 13957 sogo_5.12.1-3+deb13u3_armhf-buildd.buildinfo
 4f83efe09a9147f4df4a3841691ede9285626ebce7b2084fa0f4bf296752b9a4 1350260 sogo_5.12.1-3+deb13u3_armhf.deb
Files:
 5cf3fe2b6b0481140f142b0a099f63de 107712 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_armhf.deb
 f6c82ad660e3ec275746a084edce5812 258464 mail optional sogo-activesync_5.12.1-3+deb13u3_armhf.deb
 44f85aef79b7570dc13153daba26ff3a 1276892 debug optional sogo-dbgsym_5.12.1-3+deb13u3_armhf.deb
 1c50d6686ac6e601aa697d8e0eb99d66 13957 mail optional sogo_5.12.1-3+deb13u3_armhf-buildd.buildinfo
 deaeae535505d0fadb85749ddfbb9023 1350260 mail optional sogo_5.12.1-3+deb13u3_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmrPDJYACgkQXVp1sEH/
1mIrnQ/+MGgpl9qhaoM6Agm23CdDSNDby5D6xF1r4f3wapkE8+1681Yg5aD8FT9U
5v/MTT3dPYVN6N9qkv3LuOg56uO7/YxGApXpviNK2U4997qCukoYNKkGGmWe7QeY
06KVnvbV+jSEIzz9plLfF7LBSR6IdaXrzTl4dvbbQpf9cZZVorlShocK3HOctog4
eqlZ8ju2NnQTvYspspwguWS1PpvRdifXRxBC+yL2ftTpOmhlUbRJmIFmRpawXHtD
3m4LSrMPFWeJRfPd72jWkRxJluociaCn6auetorwtr59/dr0B4dp32X2RgWagwuR
sBrC+5cq8M8PrLjZ+6qryYp1rettyg7R111WxwDrUVYzQP1JOVCQ5RQyJ60+98gv
XRGZX+oBWVr4k7C0YokTUEzZ7InpJfZFyQ/1g1qHClJUlo6THDGFEL2diQe6If1x
mEB4rLu7eRorXQc2yLhpqBkwSIsN2NaDTcxzMe43uFxDzm3nPIkQLh3DrPzbxSIX
A0lH85Cq5TRwHYsEoKyb+IJP1EMh5wm1TqpjOqt9zCWMw7jL5AibqgXl3qhHxvXH
yCIcvB8KQaSbwyyUfjG2xET++BJuHhHlEqjxCrjdNtM8fuGtLkALgQB/xTeRJx6I
BqN9FWYcDQoC31TnW4F6CFkKBnvUohPW+qZTQmCyf/Ov34BLQlE=
=NuxN
-----END PGP SIGNATURE-----