-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: s390x
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: s390x Build Daemon (zandonai) <buildd_s390x-zandonai@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 fb3186d9a334fb786c03afc1f42a7e9deb33b7e5 103536 sogo-activesync-dbgsym_5.12.1-3+deb13u3_s390x.deb
 3efbc62d6339cd1fea024c49f75d2878d95e173a 239880 sogo-activesync_5.12.1-3+deb13u3_s390x.deb
 10e2eea48de2b395bc4b19a738cd3940a5c36978 1195948 sogo-dbgsym_5.12.1-3+deb13u3_s390x.deb
 3608a879459cff2df26462cb001c7ed53632f902 13881 sogo_5.12.1-3+deb13u3_s390x-buildd.buildinfo
 d312c67f14d9b43e36cd8bda16f3e82dc069e326 1372380 sogo_5.12.1-3+deb13u3_s390x.deb
Checksums-Sha256:
 2420d50554113aa1b7415a0413298bba164bf24fccb7ea84ea32c58c379eadb3 103536 sogo-activesync-dbgsym_5.12.1-3+deb13u3_s390x.deb
 45a01157937fd243a38c3fd14b6e10442655978fbdfaf7f6d66f1a5eebed8f27 239880 sogo-activesync_5.12.1-3+deb13u3_s390x.deb
 dca66c24e558e32e5453d1062743202c6956ee03a807159dec0ceea5e2626d9b 1195948 sogo-dbgsym_5.12.1-3+deb13u3_s390x.deb
 9e37c296ceee3d8933307d5e577ed07fe71bd6fafbec4ab09af418c7ace1ae93 13881 sogo_5.12.1-3+deb13u3_s390x-buildd.buildinfo
 8edb5239e0b7cf6df39092506332f6105dafc2db920b7be95e5045bcd7e71509 1372380 sogo_5.12.1-3+deb13u3_s390x.deb
Files:
 cc348f4269722ed1de435058e29d39cd 103536 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_s390x.deb
 427415f4a241a509e7066a95849157fe 239880 mail optional sogo-activesync_5.12.1-3+deb13u3_s390x.deb
 1a4320893bf3b03ab57dd6813f45534d 1195948 debug optional sogo-dbgsym_5.12.1-3+deb13u3_s390x.deb
 a7d0d8d7fe9b6bf0364724f274427d2f 13881 mail optional sogo_5.12.1-3+deb13u3_s390x-buildd.buildinfo
 4cc610c928f119bead2199a9d7638e6d 1372380 mail optional sogo_5.12.1-3+deb13u3_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEPFXUCSHwedwJxYxMojUpyTy8GroFAmrPDF8ACgkQojUpyTy8
GrpfVA//d/CVNijIPpNcJr9HjgTNbd6/KSxr4GqZzSbV2jQLVX3YgkfbigeqwMD3
U3LXAiHjvh5JeDT58mFk5lxKQoBnxUnuhuqQgpg7HcJEd28HsRMYqbCZKWgmrwNI
o36x952t5ktNd3wU3P7iYgu8EVBuy/gWATWcWOH3br08O0D/pCcVtNY3l9wPD/6q
nHx1YSxnEkJ1IWxtnw3ASIGQxYoModAuZtFkuIWTfpeHhF6JcwWcDmrXENlkZNuy
6oK+cRuwpOKOH3WFV+Tdhkl5/i/Tw2GLC2EgWHQEf9HGyk5NilrayOuw6Ys7mul0
jhMkaQIzKxB7QjfYgGsu9VaAJhXDm/REG93O0RveU2sE98kBYZE10aOW0HtjuWsS
K/TV3dU0CZ8kk8S8FjTjXltcldi3RE9vNIvvVHXrvTDbu0uq8YvGlp+feAB/3Z7h
Rct8Fwuz8Y1dq7D0bw1OxLhYZTjPo0Z5dSfChsUBgizo0PLY7o/90nOb1zju3yMG
7QC8ixHO9R4Z+8AjO12xcrXoQhCkm17rmM9iMnUQmEci6i4+iV62jjxZIeaezKnr
1cLSPeFQ/6rgj+akJosKq4cXMQiV4WpEkyihUtySfLbjyKQMS6EofSsTqSvsp9mm
drg6TTfbkuWpFQKRHnLCxZkiY8nHhtqvgblaq4K7tMgYVpgkcm4=
=BMiV
-----END PGP SIGNATURE-----