Your message dated Sat, 17 Oct 2026 14:34:19 +0000
with message-id <[email protected]>
and subject line Bug#1148454: fixed in sogo 5.12.1-3+deb13u3
has caused the Debian Bug report #1148454,
regarding sogo: CVE-2026-93453
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148454: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148454
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sogo
Version: 5.12.10-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for sogo.
CVE-2026-93453[0]:
| SOGo before 5.12.11 constructs password-reset links using the
| client-supplied Origin header as the authority, allowing
| unauthenticated attackers to redirect recovery tokens to attacker-
| controlled domains. Attackers can submit password recovery requests
| with a malicious Origin header to have valid password-reset tokens
| mailed to victim recovery addresses within links pointing to
| attacker infrastructure, enabling account takeover.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93453
https://www.cve.org/CVERecord?id=CVE-2026-93453
[1] https://www.sogo.nu/news/2026/sogo-v51211-released.html
[2]
https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba
[3]
https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: sogo
Source-Version: 5.12.1-3+deb13u3
Done: Peter Wienemann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
sogo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Peter Wienemann <[email protected]> (supplier of updated sogo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Architecture: source
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian SOGo Maintainers
<[email protected]>
Changed-By: Peter Wienemann <[email protected]>
Closes: 1142810 1148454
Changes:
sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
.
* Non-maintainer upload.
* Add patch to fix a regression introduced by fix for CVE-2026-33550
(Closes: #1142810)
* Add patch to fix shell injection by disabling sendmail
* Add patch to fix SQL injection: properly parse MKCOL request
* Add patch to fix XSS: escape angularJS directive for description
* Add patch to add stripAngular to stringWithoutHTMLInjection calls
This is a follow-up change to the XSS fix escaping angularJS directive.
* Add patch to fix SSRF: do not transmit og http status to external calendar
* Add patch to fix CVE-2026-93453: password reset poisoning
(Closes: 1148454)
* Add patch to fix XSS: use legitimate sorting value
* Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc
4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712
sogo_5.12.1-3+deb13u3.debian.tar.xz
189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842
sogo_5.12.1-3+deb13u3_amd64.buildinfo
Checksums-Sha256:
0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439
sogo_5.12.1-3+deb13u3.dsc
7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712
sogo_5.12.1-3+deb13u3.debian.tar.xz
f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842
sogo_5.12.1-3+deb13u3_amd64.buildinfo
Files:
680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc
ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional
sogo_5.12.1-3+deb13u3.debian.tar.xz
bd83aad074acf70f53613808082d45f7 14842 mail optional
sogo_5.12.1-3+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2
QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF
LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS
YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a
hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr
WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh
rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs
aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR
wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8
n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18
yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb
+wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8
1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=
=YPWx
-----END PGP SIGNATURE-----
pgpxyEIyd2NWJ.pgp
Description: PGP signature
--- End Message ---
