Version in base suite: 5.12.1-3+deb13u2 Base version: sogo_5.12.1-3+deb13u2 Target version: sogo_5.12.1-3+deb13u3 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/sogo/sogo_5.12.1-3+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/sogo/sogo_5.12.1-3+deb13u3.dsc changelog | 18 patches/CVE-2026-33550_regression_fix.patch | 23 patches/CVE-2026-93453_1.patch | 26 patches/CVE-2026-93453_2.patch | 145 ++++ patches/add_stripAngular_to_stringWithoutHTMLInjection.patch | 56 + patches/disable_sendmail_to_fix_shell_injection.patch | 60 + patches/fix_sql_injection_properly_parse_mkcol_request.patch | 319 ++++++++++ patches/fix_ssrf_do_not_transmit_og_http_status_to_external_calendar.patch | 58 + patches/fix_xss_escape_angularjs_directive.patch | 316 +++++++++ patches/fix_xss_pr395.patch | 273 ++++++++ patches/fix_xss_use_legitimate_sorting_value.patch | 113 +++ patches/series | 10 12 files changed, 1417 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpmmma09ab/sogo_5.12.1-3+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpmmma09ab/sogo_5.12.1-3+deb13u3.dsc: no acceptable signature found diff -Nru sogo-5.12.1/debian/changelog sogo-5.12.1/debian/changelog --- sogo-5.12.1/debian/changelog 2026-06-15 19:26:37.000000000 +0000 +++ sogo-5.12.1/debian/changelog 2026-10-11 17:27:09.000000000 +0000 @@ -1,3 +1,21 @@ +sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium + + * Non-maintainer upload. + * Add patch to fix a regression introduced by fix for CVE-2026-33550 + (Closes: #1142810) + * Add patch to fix shell injection by disabling sendmail + * Add patch to fix SQL injection: properly parse MKCOL request + * Add patch to fix XSS: escape angularJS directive for description + * Add patch to add stripAngular to stringWithoutHTMLInjection calls + This is a follow-up change to the XSS fix escaping angularJS directive. + * Add patch to fix SSRF: do not transmit og http status to external calendar + * Add patch to fix CVE-2026-93453: password reset poisoning + (Closes: 1148454) + * Add patch to fix XSS: use legitimate sorting value + * Add patch to fix XSS issues addressed in upstream PR 395 + + -- Peter Wienemann Sun, 11 Oct 2026 19:27:09 +0200 + sogo (5.12.1-3+deb13u2) trixie-security; urgency=medium * Non-maintainer upload. diff -Nru sogo-5.12.1/debian/patches/CVE-2026-33550_regression_fix.patch sogo-5.12.1/debian/patches/CVE-2026-33550_regression_fix.patch --- sogo-5.12.1/debian/patches/CVE-2026-33550_regression_fix.patch 1970-01-01 00:00:00.000000000 +0000 +++ sogo-5.12.1/debian/patches/CVE-2026-33550_regression_fix.patch 2026-10-11 17:27:09.000000000 +0000 @@ -0,0 +1,23 @@ +From: Hivert Quentin +Date: Thu, 19 Mar 2026 13:30:28 +0100 +Subject: fix(totp): new user can properly use totp + +Origin: upstream, https://github.com/Alinto/sogo/commit/623f083cd94842766c6d9430cf3bdad8fc4d5dbc.diff +--- + UI/MainUI/SOGoRootPage.m | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m +index d4717c8..79130bc 100644 +--- a/UI/MainUI/SOGoRootPage.m ++++ b/UI/MainUI/SOGoRootPage.m +@@ -418,7 +418,8 @@ static const NSString *kJwtKey = @"jwt"; + } + else + { +- if ([us dictionaryForKey: @"General"] && ![[us dictionaryForKey: @"General"] objectForKey: @"PrivateSalt"]) ++ if ([us dictionaryForKey: @"General"] && !([[us dictionaryForKey: @"General"] objectForKey: @"PrivateSalt"] || ++ [[us dictionaryForKey: @"General"] objectForKey: @"totpKey"])) + { + // Since v5.3.0, a new salt is used for TOTP. If it's missing, disable TOTP and alert the user. + [ud setTotpEnabled: NO]; diff -Nru sogo-5.12.1/debian/patches/CVE-2026-93453_1.patch sogo-5.12.1/debian/patches/CVE-2026-93453_1.patch --- sogo-5.12.1/debian/patches/CVE-2026-93453_1.patch 1970-01-01 00:00:00.000000000 +0000 +++ sogo-5.12.1/debian/patches/CVE-2026-93453_1.patch 2026-10-11 17:27:09.000000000 +0000 @@ -0,0 +1,26 @@ +From: Hivert Quentin +Date: Mon, 7 Sep 2026 16:26:09 +0200 +Subject: use the proper url for reset password mail (part 1) + +Origin: upstream, https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba.diff +Bug-Debian: https://bugs.debian.org/1148454 +--- + UI/MainUI/SOGoRootPage.m | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m +index 7556723..71b8294 100644 +--- a/UI/MainUI/SOGoRootPage.m ++++ b/UI/MainUI/SOGoRootPage.m +@@ -1367,8 +1367,9 @@ static const NSString *kJwtKey = @"jwt"; + + // Send mail + mailer = [SOGoMailer mailerWithDomainDefaults: dd]; +- url = [NSString stringWithFormat:@"%@%@?token=%@" +- , [[request headers] objectForKey:@"origin"] ++ ++ url = [NSString stringWithFormat:@"%@/%@?token=%@" ++ , [[context serverURL] absoluteString] + , [request uri] + , jwtToken]; + diff -Nru sogo-5.12.1/debian/patches/CVE-2026-93453_2.patch sogo-5.12.1/debian/patches/CVE-2026-93453_2.patch --- sogo-5.12.1/debian/patches/CVE-2026-93453_2.patch 1970-01-01 00:00:00.000000000 +0000 +++ sogo-5.12.1/debian/patches/CVE-2026-93453_2.patch 2026-10-11 17:27:09.000000000 +0000 @@ -0,0 +1,145 @@ +From: Hivert Quentin +Date: Thu, 10 Sep 2026 08:11:23 +0200 +Subject: use the proper url for reset password mail (part 2) + +Origin: backport, https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829.diff +Bug-Debian: https://bugs.debian.org/1148454 +--- + .devcontainer/conf/sogo/sogo.conf | 2 +- + Documentation/SOGoInstallationGuide.asciidoc | 18 ++++++++++++++++++ + SoObjects/SOGo/SOGoSystemDefaults.h | 1 + + SoObjects/SOGo/SOGoSystemDefaults.m | 5 +++++ + UI/MainUI/SOGoRootPage.m | 27 ++++++++++++++++++++++++--- + 5 files changed, 49 insertions(+), 4 deletions(-) + +diff --git a/.devcontainer/conf/sogo/sogo.conf b/.devcontainer/conf/sogo/sogo.conf +index 75a6240..cb7d4a1 100644 +--- a/.devcontainer/conf/sogo/sogo.conf ++++ b/.devcontainer/conf/sogo/sogo.conf +@@ -15,9 +15,9 @@ + * * + * **************************************************************************/ + +- /* Database configuration (mysql://, postgresql:// or oracle://) */ + WOPort = "0.0.0.0:50000"; + ++ /* Database configuration (mysql://, postgresql:// or oracle://) */ + + // MySQL + SOGoProfileURL = "mysql://sogobuild:sogo123@mariadb:3306/sogo/sogo_user_profile"; +diff --git a/Documentation/SOGoInstallationGuide.asciidoc b/Documentation/SOGoInstallationGuide.asciidoc +index 9853063..292ef02 100644 +--- a/Documentation/SOGoInstallationGuide.asciidoc ++++ b/Documentation/SOGoInstallationGuide.asciidoc +@@ -838,6 +838,16 @@ Obiously, if your users can connect without specifying a domain, let this parame + |S |SOGoPasswordRecoveryEnabled + |Boolean enable password recovery with secret question or secondary e-mail. Default value is `NO`. + ++|S |SOGoPasswordRecoveryBaseURLs ++| *Since 5.12.11*. Whitlist of base URL for password reset link. ++ ++`SOGoPasswordRecoveryBaseURLs = ("https://demo.sogo.nu");` ++`SOGoPasswordRecoveryBaseURLs = ("https://platform1.sogo.nu", "https://platform2.sogo.nu);` ++ ++Do not end the URLs by '/'. ++ ++No defaults, will trhow an error if empty or unset. ++ + |S |SOGoPasswordRecoveryDomains + |List of domains where password recovery is enabled, for example `(example.org, example.net)`. If empty array `()`, disabled for all domains. If not set, enabled for all domains. + +@@ -2887,6 +2897,11 @@ SOGoMailJunkSettings = { + }; + ---- + ++|D |mailJunkIcon ++|Choose the Junk icon. For the thumb down `thumb_down`, for a shield `gpp_bad`. ++ ++Defaults to `gppthumb_down_bad`. ++ + |D |SOGoMailKeepDraftsAfterSend + |Parameter used to keep mails in the drafts folder once they have been + sent by SOGo. Defaults to `NO` when unset. +@@ -4123,6 +4138,9 @@ current version of SOGo from the previous release. + [cols="100a"] + |======================================================================= + ++h|5.12.11 ++|If you enable Password Recovery, new mandatory settings `SOGoPasswordRecoveryBaseURLs` ++ + h|5.11 + |Parameters `SOGoGlobalAddressBookFirstEntries` and `SOGoGlobalAddressBookFirstEntriesCount` has been removed. Please use `listRequiresDot` and `globalAddressBookFirstEntriesCount` instead. Signature are now between a div tag to avoid CKEditor changing the content - set `SOGoForceRawHtmlSignature` to `NO` to leave signature (https://bugs.sogo.nu/view.php?id=5920). + +diff --git a/SoObjects/SOGo/SOGoSystemDefaults.h b/SoObjects/SOGo/SOGoSystemDefaults.h +index fc5729e..78026c5 100644 +--- a/SoObjects/SOGo/SOGoSystemDefaults.h ++++ b/SoObjects/SOGo/SOGoSystemDefaults.h +@@ -149,6 +149,7 @@ NSComparisonResult languageSort(id el1, id el2, void *context); + - (BOOL) isEasUIDisabled; + + - (BOOL)isPasswordRecoveryEnabled; ++- (NSArray *) passwordRecoveryBaseURLs; + - (NSArray *) passwordRecoveryDomains; + - (NSString *) JWTSecret; + +diff --git a/SoObjects/SOGo/SOGoSystemDefaults.m b/SoObjects/SOGo/SOGoSystemDefaults.m +index a64ff76..e642dfd 100644 +--- a/SoObjects/SOGo/SOGoSystemDefaults.m ++++ b/SoObjects/SOGo/SOGoSystemDefaults.m +@@ -1086,6 +1086,11 @@ NSComparisonResult languageSort(id el1, id el2, void *context) + return [self boolForKey: @"SOGoPasswordRecoveryEnabled"]; + } + ++- (NSArray *) passwordRecoveryBaseURLs ++{ ++ return [self stringArrayForKey: @"SOGoPasswordRecoveryBaseURLs"]; ++} ++ + - (NSArray *) passwordRecoveryDomains + { + static NSArray *passwordRecoveryDomains = nil; +diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m +index 71b8294..a6accaa 100644 +--- a/UI/MainUI/SOGoRootPage.m ++++ b/UI/MainUI/SOGoRootPage.m +@@ -1316,7 +1316,8 @@ static const NSString *kJwtKey = @"jwt"; + */ + - (WOResponse *) passwordRecoveryEmailAction + { +- NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent; ++ NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent, *serverUrl; ++ NSArray *baseUrls; + NSDictionary *message, *info; + WORequest *request; + SOGoUserManager *um; +@@ -1368,8 +1369,28 @@ static const NSString *kJwtKey = @"jwt"; + // Send mail + mailer = [SOGoMailer mailerWithDomainDefaults: dd]; + +- url = [NSString stringWithFormat:@"%@/%@?token=%@" +- , [[context serverURL] absoluteString] ++ //Get Allowed server URL and check if it's OK ++ baseUrls = [[SOGoSystemDefaults sharedSystemDefaults] passwordRecoveryBaseURLs]; ++ serverUrl = [[request headers] objectForKey:@"origin"]; ++ ++ if(!(baseUrls && [baseUrls count] > 0)) ++ { ++ [self logWithFormat: @"Password recovery exception for user %@: empty or unset SOGoPasswordRecoveryBaseURLs", uid]; ++ response = [self responseWithStatus: 403 ++ andString: @"Password recovery email in error"]; ++ return response; ++ } ++ ++ if(![baseUrls containsObject:serverUrl]) ++ { ++ [self logWithFormat: @"Password recovery exception for user %@: invalid request header", uid]; ++ response = [self responseWithStatus: 403 ++ andString: @"Password recovery email in error"]; ++ return response; ++ } ++ ++ url = [NSString stringWithFormat:@"%@%@?token=%@" ++ , serverUrl + , [request uri] + , jwtToken]; + diff -Nru sogo-5.12.1/debian/patches/add_stripAngular_to_stringWithoutHTMLInjection.patch sogo-5.12.1/debian/patches/add_stripAngular_to_stringWithoutHTMLInjection.patch --- sogo-5.12.1/debian/patches/add_stripAngular_to_stringWithoutHTMLInjection.patch 1970-01-01 00:00:00.000000000 +0000 +++ sogo-5.12.1/debian/patches/add_stripAngular_to_stringWithoutHTMLInjection.patch 2026-10-11 17:27:09.000000000 +0000 @@ -0,0 +1,56 @@ +From: Hivert Quentin +Date: Tue, 11 Aug 2026 17:06:27 +0200 +Subject: incorrect method called + +Origin: upstream, https://github.com/Alinto/sogo/commit/1caa25711f5891135c7ebca63f33b8758c00c8e8.diff +--- + SoObjects/Mailer/SOGoDraftObject.m | 2 +- + Tests/Unit/TestNSString+Utilities.m | 22 +++++++++++----------- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/SoObjects/Mailer/SOGoDraftObject.m b/SoObjects/Mailer/SOGoDraftObject.m +index c36946c..ccb3db6 100644 +--- a/SoObjects/Mailer/SOGoDraftObject.m ++++ b/SoObjects/Mailer/SOGoDraftObject.m +@@ -322,7 +322,7 @@ static NSString *userAgent = nil; + + - (void) setText: (NSString *) newText + { +- ASSIGN (text, [newText stringWithoutHTMLInjection: NO]); ++ ASSIGN (text, [newText stringWithoutHTMLInjection: NO stripAngular: NO]); + } + + - (NSString *) text +diff --git a/Tests/Unit/TestNSString+Utilities.m b/Tests/Unit/TestNSString+Utilities.m +index 71ccd08..ff25506 100644 +--- a/Tests/Unit/TestNSString+Utilities.m ++++ b/Tests/Unit/TestNSString+Utilities.m +@@ -99,17 +99,17 @@ + + - (void) test_stringWithoutHTMLInjection + { +- testEquals([[NSString stringWithString:@"foobar"] stringWithoutHTMLInjection: YES], @" foo bar"); +- testEquals([[NSString stringWithString:@"fb "] stringWithoutHTMLInjection: YES], @"fb "); +- testEquals([[NSString stringWithString:@"Test\n