-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: riscv64
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: riscv64 Build Daemon (rv-manda-02) <buildd_riscv64-rv-manda-02@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 ae1571103cac070a90a1a082769bbcd9cf0c4c54 106152 sogo-activesync-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 a28704575f0e1a112d4c8896b0be2caac2bc5b1e 239824 sogo-activesync_5.12.1-3+deb13u3_riscv64.deb
 1e4b7a5a36f3099f39c0763ae52e4c799b4d4a44 1233976 sogo-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 bda976743289232e11c2cada4b3d0256d2840467 14070 sogo_5.12.1-3+deb13u3_riscv64-buildd.buildinfo
 1bbf8b21c67c849238c6db6d80174714a9219808 1311200 sogo_5.12.1-3+deb13u3_riscv64.deb
Checksums-Sha256:
 ce81d1ee985f3b7eb7f461973f81f26443384059a55d3f52590d52e6ef3562d7 106152 sogo-activesync-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 9126a34b4c1a5f61a14aed16d1836c4cc9b7fdfa0b43beb75a2547056a8a88b0 239824 sogo-activesync_5.12.1-3+deb13u3_riscv64.deb
 d514a9713702ab06c58004fa6d167115be13d3775384bee375c18cfe842bd459 1233976 sogo-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 02fb53a32700e679abc3ce74fba48860f7739415aebe0ad0f215f4419540c96e 14070 sogo_5.12.1-3+deb13u3_riscv64-buildd.buildinfo
 2b13352e6831b5e51356ac66e830e7a2f214ae96fe4f77c6c6d329abf40bcaeb 1311200 sogo_5.12.1-3+deb13u3_riscv64.deb
Files:
 d1aeadb9dd9e1c0ea3c28f8c6503764b 106152 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 b404a61bc1d25b7d8dd6f01ab5dcba97 239824 mail optional sogo-activesync_5.12.1-3+deb13u3_riscv64.deb
 52d49cc870fabe589f01af6299025633 1233976 debug optional sogo-dbgsym_5.12.1-3+deb13u3_riscv64.deb
 ff7a8b6b5c7d78a7133dbe85b6af6dc6 14070 mail optional sogo_5.12.1-3+deb13u3_riscv64-buildd.buildinfo
 6d97713ed16d516c3986cf22d90d479b 1311200 mail optional sogo_5.12.1-3+deb13u3_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEER+evXFzNzDWbUDPF7SlJcp2g6OIFAmrPEKAACgkQ7SlJcp2g
6OJhhA//YHD/ARhNwVYPi0lR0dkCynxmST+3sIt+rTZl/TTuW0VQqJqebvYyyOLT
Ke/pAuoWYOdXPcI4imUgYhcYftaGU7qum5ax7ZKywNJBlnlmzCcDunbN3HrKZi+A
a/oVT36VP0YPTygUJXyj3SlJ8z4HJu6jFxw6OzdLoiImTIILocnNKl9QBJYkv2GM
5akjzwCVQKyj4MohnfzbCWU4mWaNMKrWOBcWqlCbl2zHM+xgTOItS+XPiOUqFx8G
uuyaw4Zpx4A7PG0Kwi9qpJk1EA6rZ9HpX7CtAjvKwrmZbJhlEvuTej/Cn8ypqEsy
jtqFiqkIoEZ4EhIRMtXrNi5UiPNjs3LahLuhj+cFXNMWPr4cc8OMvUSk9prO4tg9
isPEp3MJWk+gQWHsSQUMJ0IyEtfdyBjzjeS2JzqFwN2OyI0dw8JxMFNwWA18aNVR
gMRfQZJiWsTHjitX0s5OOBhpi1+s88jdbiTipr7eMlMrNozUWSCqk+0uAa+rLlzn
S8LtNlhokj6z5l1EgsLUqsUj4QNDyxv4+dxXMr7OTDTvCYlh+n4aIEl4jPPIYnt8
aTQ7aNJ7D6hk9yJyjFaYaE0I91uyKTCnwulehPeLj42i0WiOG93O7peIrtvKDBGi
/2LA7Pg9M1cuXvK18KsOS/wZ1l6Xbf7uHSe35EzTwY62dUV8Smw=
=uGl9
-----END PGP SIGNATURE-----