Your message dated Fri, 9 Feb 2024 22:15:20 +0100
with message-id <[email protected]>
and subject line Re: Accepted sogo 5.9.1-1 (source) into unstable
has caused the Debian Bug report #1060925,
regarding sogo: CVE-2023-48104
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1060925: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060925
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sogo
Version: 5.8.4-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for sogo.
CVE-2023-48104[0]:
| Alinto SOGo 5.8.0 is vulnerable to HTML Injection.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-48104
https://www.cve.org/CVERecord?id=CVE-2023-48104
[1]
https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: sogo
Source-Version: 5.9.1-1
Fixes CVE-2023-48104, #1060925, so closing it with this version.
On Fri, Feb 09, 2024 at 07:59:18PM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Wed, 07 Feb 2024 16:39:36 +0100
> Source: sogo
> Architecture: source
> Version: 5.9.1-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian SOGo Maintainers
> <[email protected]>
> Changed-By: Jordi Mallach <[email protected]>
> Changes:
> sogo (5.9.1-1) unstable; urgency=medium
> .
> * New upstream release.
> * Revert all unvendoring changes as they completely break SOGo.
> * Rely on dh_installinit to install the systemd service file.
> * Refresh Remove-build-date.patch.
> * Update number of expected test failures to 1.
> * Release to unstable.
> Checksums-Sha1:
> a0de7bcc140f48cbee4b3a1c65a4875e0fa1fd17 2264 sogo_5.9.1-1.dsc
> 4674851c65672b7070023dbdae2eef9b8ddf0280 34831391 sogo_5.9.1.orig.tar.gz
> 580e185dca322a62032869a1f3b8bce688d07112 18276 sogo_5.9.1-1.debian.tar.xz
> 36366d5cec0c489b7d637764f4128fb441a7b4fa 11322 sogo_5.9.1-1_amd64.buildinfo
> Checksums-Sha256:
> c1372ed8ede354b7ef534ec94ad0b28097c937d6120406fd74c2cfbb707b4832 2264
> sogo_5.9.1-1.dsc
> df6ac305a99196ee66d60fda395af81d8da044e7f5c1b1603a51dc4a8edf8ac4 34831391
> sogo_5.9.1.orig.tar.gz
> 8f211e9ebbd87ee81f4869c940d96d4a749b0d21fa564174e3ca7148c7ce33e8 18276
> sogo_5.9.1-1.debian.tar.xz
> bc7bd540fe6520504bc15af43607b45ec58dedb244c1976646fce982d3782f56 11322
> sogo_5.9.1-1_amd64.buildinfo
> Files:
> 10df580323cea3434bdca93dfcbe5c39 2264 mail optional sogo_5.9.1-1.dsc
> a260fe92c447f0b185dbd6ebeb411907 34831391 mail optional
> sogo_5.9.1.orig.tar.gz
> 36387abcff529a9720a676365085dd5f 18276 mail optional
> sogo_5.9.1-1.debian.tar.xz
> f48324600482875ab6b6b90067035549 11322 mail optional
> sogo_5.9.1-1_amd64.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEE6BdUhsApKYN8KGoWJVAvb8vjywQFAmXGas4ACgkQJVAvb8vj
> ywQuMxAAm6BBOyqtWJ2panPGkdREkfOW+uvM480CVL2uEkzb5lSkedmyHQ1WU2P5
> lDsXYj0cZbA9Qkjyf1jZqjOCRWW472FPBYkrG19oeS4Qnc3t8HN17Urv13lSrWm1
> A0rCqDBGaI+uPSRI33DfkEbuc2BvZnb9l6gbeSgEyONRKbQ1IsuseQyS6Kuc/plu
> vqvCWC2/Bi3YTjvxSYfKwqDJggd/6LtNPok0rL2++Iu6gD9i9NHZY/nLe2hyqzqQ
> sMcejzJB0Gc3ZtDeQVD7kr9IMZnLUQUra5wby8XrbQx6YSzw7fJ/fhemczqicJ67
> CfTCtRs0TzDQlzA5UxsXKGEcGVsIKDfD59Cbhfdv6EnEDCcnsAUf4wC+GStjtI8n
> 8tN4rU6WOdS3suW2ZdxTco7ujpxyimcxHe/Z2ruO44XWuaOK6XN2EqweULfUc5cR
> 3qkPpGftHbZUQh12at4enjL85EpMOXf832jMiamaNnwwgQE9rtisCfphOUOz8rLX
> xWEjCqPkJ8JQPQeCTghJK0rWonZfLMgi6ooLOco9BOZWMtuEF/BmaVsfTOR0zafq
> YoGMot69JzIQbVcbpbBhNHSwa6IXW1nzzm3V40cajM4p3lubb7YOesXLyGeZTPO3
> gdQ2w7CSsPLMUAZMJMG+/K3qy1epbdAANRnVPCWyR8fjR9KvPnQ=
> =j//V
> -----END PGP SIGNATURE-----
>
--- End Message ---
