-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 14 Oct 2026 23:08:12 +0200 Source: sogo Architecture: source Version: 5.12.12-1 Distribution: unstable Urgency: medium Maintainer: Debian SOGo Maintainers <[email protected]> Changed-By: Jordi Mallach <[email protected]> Changes: sogo (5.12.12-1) unstable; urgency=medium . * New upstream release with security bugfixes: - IDOR in the contact search endpoint - possible header injection through generated Message-Id domains * Cherry-pick upstream security fixes from master: - session_key_base64_check.patch: possible SQL injection via session key - draft_path_traversal.patch: path traversal through draft names - bydaymask_buffer_overflow.patch: stack overflow parsing BYDAY rules - ldap_filter_escaping.patch: LDAP filter injection * Update source lintian overrides for CKEditor 5 and long lines. * Do not ship the CKEditor sample page and build files. * Drop dependency on obsolete lsb-base. * Do not recursively change log and spool directory permissions in postinst. * Do not activate the ldconfig trigger for private libraries. * Override lintian tags for bundled Material Icons font and CKEditor 5. * Add DEP-3 headers to patches missing a description. * Drop disable_isIpv4_test.patch, fixed upstream, and refresh the rest. * Fix removal of unvendored angular modules, brace expansion needs bash. * Override privacy-breach-generic for CKEditor embeds and angular-material docs. * Update copyright for CKEditor 5. * Move arch-dependent API bundle from sogo-common to sogo. * Add missing "New upstream release" entry to previous entry. * Document security fixes and CVE ids in previous entries. Checksums-Sha1: acc82ae045c6f5a15c7084191d3df7c7642cec99 2298 sogo_5.12.12-1.dsc ac2152a5f910da9d2e3ee9483db7c8cc241fdeaa 38043562 sogo_5.12.12.orig.tar.gz 3b10e3403090f02069cfaff0704c519c495a47b5 27248 sogo_5.12.12-1.debian.tar.xz 702a6605e3747c585684d115fec58de36f385540 13627 sogo_5.12.12-1_amd64.buildinfo Checksums-Sha256: 93d07504e3df03830911ee11aa80f64c23768363fce0d0bf490f36860860d558 2298 sogo_5.12.12-1.dsc afaa47bc018829146ee7caea982c1d55d3e3c71fb4124c10d49ed67c56760517 38043562 sogo_5.12.12.orig.tar.gz 1d20fba0e90de56fa98bca0a6fa14b797fd8b6efd3acf6b08886ab10108f8ec6 27248 sogo_5.12.12-1.debian.tar.xz 023d46bb82f04ccfc2849e2e68c46fc12d896863a83c5bd188bc0f31adb9d6a1 13627 sogo_5.12.12-1_amd64.buildinfo Files: a4945706f96c157d29f31243d6d9da6b 2298 mail optional sogo_5.12.12-1.dsc 4ffb0a2e4a7a4a6b3de56980baf24447 38043562 mail optional sogo_5.12.12.orig.tar.gz e1d2e75788b39f302904340aade1c17c 27248 mail optional sogo_5.12.12-1.debian.tar.xz 857567ccd9737c73a42b6a6e63dea443 13627 mail optional sogo_5.12.12-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE6BdUhsApKYN8KGoWJVAvb8vjywQFAmrP8g8ACgkQJVAvb8vj ywQw8A/+Ief00mVR+xTpo1RWV1/FVL/ZjCb4Z3aJTICR93evDivls+lI/nhCs+E0 KI6stcF9ehvnsLr43rFjwdkGPgl5p+a619QX2jzSgSXdGbJVsQnh6iWTKltC1qfY Frj8frWHFHKXzsMYpwljQajXFvr3XKrOr52efdtThDQkXDOXPn0BQGH/SDbEMahK +T72KjtPjftovM0xaSZTf05NrrdwNUCPeTu3t/p2I45T4XobSAyOWykfPPIVrlP0 rse03a+b7i9gMcNZM48I+AOjIa6XDnzmeNmlNzpUPftwcKAVNl94oE4ouwNczCWR 4Y3jyTcs8m1vHLAH8w2CYgFT/QFTckoLx8A2KpHKOrSLf59YTkBPhFes21HdX6Pg q7BBW2mJIildm10oXEBVDEsMm4BBbOo69dJf46QXQ2MoMGtyPonNwpoLmI479QPg 7UWc6ISx5EzOKIRZXwM+0ZRRCHUAL5e3iOzkqN034sxtPfH352GRAh4EMQ/QwP4Q LFv+bM1+1DLbXxKxqrp3p4OeHqHZYZe5NHDrO9Ko0h/+t14S3TUg/cl2a6AEmiKO TKz9ekntiXymNQqtPOzD9TCDS0N3M38ZM2pHbzhXsZSJTMCFUv9Z0SzRKzCNcnp+ 26RzTCRsPA4/OJ1YKRMEP4vaFtOCV/jN1Ounn78+oKoYxroa8SA= =VMGF -----END PGP SIGNATURE-----
pgp3slzJ_6LmM.pgp
Description: PGP signature
