-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: arm64
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: arm64 Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 384bac9922a83f044d52527bcdf4ca679a2b9472 101364 sogo-activesync-dbgsym_5.12.1-3+deb13u3_arm64.deb
 be8ecb01f58a68a89c82a13ba15b0f2d8df034a7 224556 sogo-activesync_5.12.1-3+deb13u3_arm64.deb
 aefa3738a7b42e0918f1e7c73751b5bbddb320c3 1189580 sogo-dbgsym_5.12.1-3+deb13u3_arm64.deb
 2a1db4e65cecb5595517f1ac7a488f4cb7fb34c7 14098 sogo_5.12.1-3+deb13u3_arm64-buildd.buildinfo
 c85ed5d54dbce495025bf0e17eb398814659aff0 1276836 sogo_5.12.1-3+deb13u3_arm64.deb
Checksums-Sha256:
 58a462424f7664437231ff9a87b9949fc614e6c978b6b36c0008e73f7c254cfa 101364 sogo-activesync-dbgsym_5.12.1-3+deb13u3_arm64.deb
 d94982652e22dfa62ae1c9760044aa1d3b6845a70c4a7091108cabaaf4894a26 224556 sogo-activesync_5.12.1-3+deb13u3_arm64.deb
 a61dad5dee8d11ba901f425d024f87d93dcde5df2af0788b5230787872d40d8a 1189580 sogo-dbgsym_5.12.1-3+deb13u3_arm64.deb
 3c1ebe9fcdb9ec4a16a2f2c51df8f95455a24084548bc53a9f13c25a15c9e735 14098 sogo_5.12.1-3+deb13u3_arm64-buildd.buildinfo
 e1ecd7051de1ed2f400386e627f6ee9d03da52e719967e3163d302faed92cacb 1276836 sogo_5.12.1-3+deb13u3_arm64.deb
Files:
 23cb28747ce03abe4e69d41e97ef30cd 101364 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_arm64.deb
 999112d67c54fc410c271b6d9b2e0b70 224556 mail optional sogo-activesync_5.12.1-3+deb13u3_arm64.deb
 5c5f36d7eced281b10fd2b277f5e9d42 1189580 debug optional sogo-dbgsym_5.12.1-3+deb13u3_arm64.deb
 f5208fe09a9ed3448772136db5067f2a 14098 mail optional sogo_5.12.1-3+deb13u3_arm64-buildd.buildinfo
 f92f8eb6fba2a84e149373cb7bc8cbac 1276836 mail optional sogo_5.12.1-3+deb13u3_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmrPDI0ACgkQG5VHrWJm
wgdwlRAAzFw7rgqzV70E0sXUn6SaDnopwTbDlBrtIW1GO35JnoV8cHxrpY+T0eWr
slDw868l3hEFZ/IJHpSBZ2m+BLchWVeR8HxqCjXoI+xqjAv00m6tz7ARGKmAQStO
xeMniA6odtLcMRx0YItyWzL0r1Az4Az4C48fydhfFX1KeFt/PSi1PGr5jfamqp/F
KllgU/86db4jjxxFwtafkfgysLYXRR2rN1fx5km6dpLSoK7Rtwf1UXNhL+o+vkdk
mflzMDrs0VCnOJ6vBdIfamhwnzF31giTZIcCVx7fWz73YIlze80U5afBUv4pc3o7
/8gIwfRz5Sm9C4wIGP6TIUvtYZsgwx/ntRy31A97R9Yt8039Eo07Zf3KDNMVS/Vp
Qo5AyXsL4IqOsTr2/xyIZTAXH8e/ENhDjAMCx1mcJ+LHNj8hIVI4uxECmdqTtZ+5
evV0d+31j/jL1b8C03DCabD5iuQPPb4qwbemK55Vha/jLPYeQB1v8HTkIYsPex6g
ywZyOjidR7EDhYYJ5vrtLZoA07KNpDPZLyL8aqmJiI/zaA5SOgYeUcpIcJO4qwba
IBCVTOf604XbbrQnHtvNnHLHbqvMD+sICU3REvQ+Q4yJPpGTh/g8ivfes9Wa3gJa
K1RLFNfd3D04Fhdh6Ig83a+EOIA82/4h9Qz9p4E9HNrXHB7vGeM=
=Skkz
-----END PGP SIGNATURE-----