-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: armel
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: armel Build Daemon (arm-ubc-03) <buildd_arm64-arm-ubc-03@buildd.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 51069a90f548164dea0756c652ff9ae08ec35727 105888 sogo-activesync-dbgsym_5.12.1-3+deb13u3_armel.deb
 9bc98554292619f218f5c8c8080e852eb8c27a6b 259244 sogo-activesync_5.12.1-3+deb13u3_armel.deb
 232f0696b761b752ae03849368e8f2d4a4bdfd0f 1266280 sogo-dbgsym_5.12.1-3+deb13u3_armel.deb
 26b0eb6e24ed586150e7db1cedf032b48280624c 13937 sogo_5.12.1-3+deb13u3_armel-buildd.buildinfo
 ca710c0c12f831905d4ba9a90a885b125f69992d 1358428 sogo_5.12.1-3+deb13u3_armel.deb
Checksums-Sha256:
 04a8f78b018acc463453cad118de7d9eb77ff54c2f4904bc97f3ac6f8ca00d5e 105888 sogo-activesync-dbgsym_5.12.1-3+deb13u3_armel.deb
 0e462149cf3e03e1d62f069bfcb3ec25c973469b83c44a6480ed0ab91aedf5fa 259244 sogo-activesync_5.12.1-3+deb13u3_armel.deb
 718c94b09dead745cc6607b0f8c9b15ecc77a99b55d4d8436e64cc34195d7226 1266280 sogo-dbgsym_5.12.1-3+deb13u3_armel.deb
 11656935e0a9df6c13dbe3ea5fa60dcff74a8f9876ff292a753d6d1f33238405 13937 sogo_5.12.1-3+deb13u3_armel-buildd.buildinfo
 966c5619beaa4a31c1ca5ef9891c4cdcccb9fc9a8d4704bad9c42095ee10cd0f 1358428 sogo_5.12.1-3+deb13u3_armel.deb
Files:
 91d95ec37071b440eae33a43731552ee 105888 debug optional sogo-activesync-dbgsym_5.12.1-3+deb13u3_armel.deb
 8bb739b46af32559f32dbf3dd1ed56e7 259244 mail optional sogo-activesync_5.12.1-3+deb13u3_armel.deb
 2c55124778db98f55c0022f66312fd56 1266280 debug optional sogo-dbgsym_5.12.1-3+deb13u3_armel.deb
 c353426e399022829d693fa96dd7a9e4 13937 mail optional sogo_5.12.1-3+deb13u3_armel-buildd.buildinfo
 dbcd5a7f76f9509219a7e5d3806de154 1358428 mail optional sogo_5.12.1-3+deb13u3_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmrPDLgACgkQvzDqKQSG
l8UK5A//eIXHXXNJYkwkC3RU59TTRXhOwTAaPGX/bJQZ0g0jQ82QNs3AQm1oevzU
oLE90MpSPuyMYyeqf9Wo6aYmO9wDkFk6sBOIoQnup5SRYgChBaZJko4OkLR4kFcQ
N3RVU+ADFP7nHRbX+eII/0kmntjIczfPAr58Kzbd29pEx2eG/xntqgW/l9zXME+7
EUoeDhi9Liot0VJt8zPrBVlX5Y1PXmyc/jksquenI/RuWR0R/LeecY/jloiOSSvB
7dhB1OvGuOkmQvUBVsacltgsvJsThJ3OetuRvjHCmXsOeAlbBZAJqJyt08bZALK0
nOz/mlxVhiC1861wj7Oa4iS9mXy82Th+eu3eTkcPwie/ks8XcoF2frgK/Bfr04Yi
Hkz+QJOYmk2kp4c3iS7h0+wVn36ZzOiDcPAiA9B0BYtJ8VlucOZTaY3s7QypJvji
oxVC3nX8sZ0YRom7lQFr1zvwB3TZlplCjoirGJPj4qUqm+fqUnadSmxUoIHETmnR
8agEZ6SqHf6uIQWfLNio8o+E/mBSMHqvNjUx8E9f91GKGKWv9Gpf/2w4NWw7dHJo
0qyKhbSlyYPSQj/sbMsAkgWlU4tKm9OVFACd6p4QhcZxKgmpDKcMrSc0+dqcDTUF
l+ZmUS4F6kW536iFGiFVitmuoOtf3cXg1vRptpeQtIvLW4NkgdA=
=IDMK
-----END PGP SIGNATURE-----