Your message dated Sat, 17 Oct 2026 14:34:19 +0000
with message-id <[email protected]>
and subject line Bug#1142810: fixed in sogo 5.12.1-3+deb13u3
has caused the Debian Bug report #1142810,
regarding sogo: TOTP 2FA broken with SQL user source: secret stored but not
recognised at login
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142810: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142810
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sogo
Version: 5.12.1-3+deb13u2
Severity: important
Dear Maintainer,
Since the security update 5.12.1-3+deb13u2 (which backports the fix for
CVE-2026-33550), TOTP two-factor authentication can no longer be used
when the user source is an SQL (PostgreSQL) source: the secret is stored
but is not recognised at login, so 2FA is silently disabled.
Environment
-----------
- Debian 13 (trixie), sogo 5.12.1-3+deb13u2
- SOGoUserSources: type = sql, PostgreSQL view, canAuthenticate = YES,
userPasswordAlgorithm = ssha512
- Profile store: PostgreSQL table sogo_user_profile
Steps to reproduce
------------------
1. In Preferences, tick "Enable two-factor authentication using a TOTP
application", scan the QR code, and enter the confirmation code.
-> The confirmation code is accepted (setup appears to succeed).
2. Log out, then log in again.
Actual result
-------------
Instead of being prompted for the TOTP code, the user is shown:
"Two-factor authentication has been disabled for your account. Please
visit your preferences to restore its use and reconfigure your TOTP
application."
sogo.log at login shows, on every login:
SOGoRootPage New TOTP key for '<user>' must be created
Expected result
--------------
Subsequent logins should prompt for the TOTP code; 2FA should stay
enabled.
The secret IS persisted correctly
---------------------------------
Inspecting sogo_user_profile for the affected user:
- c_defaults contains "SOGoTOTPEnabled":1
- c_settings contains "totpKey" with a value of length 20
(the write path correctly applies the CVE-2026-33550 change from a
12-char to a 20-char secret).
So the *write* path stores a valid 20-character key, but the *login/read*
path does not recognise it and decides a new key "must be created", which
disables 2FA. The enable (write) and login (read) code paths appear to be
out of sync — this looks like an incomplete backport of the upstream TOTP
fix (5.12.6 / 5.12.7) onto the 5.12.1 base shipped in trixie.
Fix availability
----------------
This appears to be already fixed in the upstream 5.12.x line: sogo 5.12.9-1
is currently in testing/unstable and ships the proper upstream TOTP code
(rather than a backport onto 5.12.1). This report is therefore mainly a
request to have the corrected TOTP handling reach *stable* (trixie) as a
point/security update, since stable users on 5.12.1-3+deb13u2 with an SQL
user source currently cannot use 2FA at all.
Ruled out
---------
- Clock: server is NTP-synchronised and at the correct time.
- Authenticator app: 1Password and Google Authenticator produce the same
code, and the confirmation code is accepted, so the shown secret is
valid.
- Profile size / truncation: c_defaults is ~3.3 kB; c_defaults and
c_settings are TEXT columns (no truncation).
- memcached: healthy, zero evictions; issue persists after restarting
both sogo and memcached.
- A clean disable / restart(sogo + memcached) / re-enable cycle
reproduces the problem every time.
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.95+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages sogo depends on:
ii adduser 3.152
ii gnustep-base-runtime 1.31.1-3
ii gnustep-multiarch [gnustep-layout-multiarch] 2.9.3-6
ii init-system-helpers 1.69~deb13u1
ii libc6 2.41-12+deb13u3
ii libcrypt1 1:4.4.38-1
ii libcurl4t64 8.14.1-2+deb13u4
ii libgcc-s1 14.2.0-19
ii libglib2.0-0t64 2.84.4-3~deb13u3
ii libgnustep-base1.31 1.31.1-3
ii liblasso3t64 2.8.2-9+deb13u1
ii libmemcached11t64 1.1.4-1.1+b2
ii liboath0t64 2.6.12-1
ii libobjc4 14.2.0-19
ii libsbjson2.3t64 2.3.2-5+b1
ii libsodium23 1.0.18-1+deb13u1
ii libsope1 5.12.1-2
ii libssl3t64 3.5.6-1~deb13u2
ii libytnef0 2.1.2-1+b2
ii libzip5 1.11.3-2
ii memcached 1.6.38-1
ii sogo-common 5.12.1-3+deb13u2
ii systemd 257.13-1~deb13u1
ii sysvinit-utils [lsb-base] 3.14-4
ii zip 3.0-15
sogo recommends no packages.
Versions of packages sogo suggests:
ii postgresql 17+278
-- Configuration Files:
/etc/default/sogo changed:
PREFORK=12
/etc/sogo/sogo.conf [Errno 13] Permission non accordée: '/etc/sogo/sogo.conf'
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: sogo
Source-Version: 5.12.1-3+deb13u3
Done: Peter Wienemann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
sogo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Peter Wienemann <[email protected]> (supplier of updated sogo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Architecture: source
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian SOGo Maintainers
<[email protected]>
Changed-By: Peter Wienemann <[email protected]>
Closes: 1142810 1148454
Changes:
sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
.
* Non-maintainer upload.
* Add patch to fix a regression introduced by fix for CVE-2026-33550
(Closes: #1142810)
* Add patch to fix shell injection by disabling sendmail
* Add patch to fix SQL injection: properly parse MKCOL request
* Add patch to fix XSS: escape angularJS directive for description
* Add patch to add stripAngular to stringWithoutHTMLInjection calls
This is a follow-up change to the XSS fix escaping angularJS directive.
* Add patch to fix SSRF: do not transmit og http status to external calendar
* Add patch to fix CVE-2026-93453: password reset poisoning
(Closes: 1148454)
* Add patch to fix XSS: use legitimate sorting value
* Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc
4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712
sogo_5.12.1-3+deb13u3.debian.tar.xz
189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842
sogo_5.12.1-3+deb13u3_amd64.buildinfo
Checksums-Sha256:
0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439
sogo_5.12.1-3+deb13u3.dsc
7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712
sogo_5.12.1-3+deb13u3.debian.tar.xz
f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842
sogo_5.12.1-3+deb13u3_amd64.buildinfo
Files:
680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc
ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional
sogo_5.12.1-3+deb13u3.debian.tar.xz
bd83aad074acf70f53613808082d45f7 14842 mail optional
sogo_5.12.1-3+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2
QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF
LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS
YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a
hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr
WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh
rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs
aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR
wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8
n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18
yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb
+wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8
1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=
=YPWx
-----END PGP SIGNATURE-----
pgpekqFnR_Tge.pgp
Description: PGP signature
--- End Message ---
