Public bug reported:
## Description
The SOGo security update published as USN-8504-1 for Ubuntu 22.04 LTS makes SOGo
unusable: every login attempt fails with HTTP 501 and an Objective-C
"unrecognized selector" exception.
The ESM build of `sogo` calls a SOPE API that does not exist in the version of
`libsope1` available in jammy, and no matching `libsope1` update was published
alongside it in esm-apps.
### Affected versions
* sogo 5.5.1-1ubuntu0.1~esm1 (jammy-apps-security)
* sogo-common 5.5.1-1ubuntu0.1~esm1 (jammy-apps-security)
### Environment
* Ubuntu 22.04.5 LTS, amd64, kernel 5.15.0-179
* libsope1 5.5.1-1 (jammy/universe) — the only version available, see below
* SOGo configured with an SQL user source, MariaDB 10.11 backend
### Impact
All web logins fail. On the affected host there were **zero** successful logins
in the three days between the update being applied and the downgrade, against
11 attempts. Where SOGo is the only webmail client, this is a complete webmail
outage.
`apt` gives no warning, because the dependency is formally satisfied (see
below),
so the breakage only surfaces at the first login attempt after the update.
---
## Steps to reproduce
1. On Ubuntu 22.04 with esm-apps enabled, install `sogo` 5.5.1-1ubuntu0.1~esm1
with a SQL user source.
2. Open the SOGo web interface. The login page renders normally (HTTP 200).
3. Submit valid credentials.
**Expected:** `POST /SOGo/connect` returns 200 and the mailbox loads.
**Actual:** `POST /SOGo/connect` returns 501. `/var/log/sogo/sogo.log`
shows:
```
EXCEPTION: <NSException: 0x...> NAME:NSInvalidArgumentException
REASON:-[EOKeyValueQualifier appendSQLToString:withAdaptor:]: unrecognized
selector sent to instance 0x... INFO:(null)
127.0.0.1 "POST /SOGo/connect HTTP/1.1" 501 0/114 0.002 - - 0 - 22
```
Note that the login *page* returns HTTP 200 throughout, so a check that only
probes the web root will not detect this.
---
## Root cause
The `appendSQLToString:withAdaptor:` selector is called by the ESM build of
libSOGo, but is not implemented by any library shipped in `libsope1 5.5.1-1`.
Call site is present in the ESM build:
```
# grep -rl 'appendSQLToString' /usr/lib/GNUstep/ /usr/sbin/sogod
/usr/lib/*.so.4.9.*
/usr/lib/GNUstep/Frameworks/SOGo.framework/Versions/5/sogo/libSOGo.so.5.5.1
```
Implementation is absent from every library and adaptor bundle in
libsope1:
```
# strings /usr/lib/libGDLAccess.so.4.9.63 | grep -c appendSQLToString
0
# strings /usr/lib/libEOControl.so.4.9.74 | grep -c appendSQLToString
0
# strings /usr/lib/GNUstep/GDLAdaptors-4.9/MySQL.gdladaptor/MySQL | grep -c
appendSQLToString
0
# strings /usr/lib/GNUstep/GDLAdaptors-4.9/PostgreSQL.gdladaptor/PostgreSQL |
grep -c appendSQLToString
0
```
No updated SOPE package exists in esm-apps — the pocket ships only the three
sogo binaries:
```
# awk '/^Package: /{p=$2} /^Version: /{if (p ~ /sope|sogo/) print p, $2}' \
/var/lib/apt/lists/esm.ubuntu.com_apps_ubuntu_dists_jammy-apps-security_main_binary-amd64_Packages
sogo 5.5.1-1ubuntu0.1~esm1
sogo-activesync 5.5.1-1ubuntu0.1~esm1
sogo-common 5.5.1-1ubuntu0.1~esm1
# apt-cache madison libsope1
libsope1 | 5.5.1-1 | http://archive.ubuntu.com/ubuntu jammy/universe amd64
Packages
```
The dependency does not catch this, because it is satisfied by the old
library:
```
# dpkg -s sogo | grep -E '^(Version|Depends)'
Version: 5.5.1-1ubuntu0.1~esm1
Depends: ..., libsope1 (>= 5.5.1), ...
```
`libsope1 5.5.1-1` satisfies `>= 5.5.1`, so apt installs the update without
complaint even though the ABI/API expectation is not met.
### Upstream context
Upstream introduces these call sites in commit
[`1f7e5d2`](https://github.com/Alinto/sogo/commit/1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21)
("fix(sql): use proper sql adaptor for usr source", PR #379), which modifies
`SoObjects/SOGo/SQLSource.m` and adds `[qualifier appendSQLToString: sql
withAdaptor: adaptor]` in, among others,
`checkLogin:grace:disablepasswordPolicyCheck:`
— i.e. exactly the login path. The related SQL-escaping hardening is in commit
[`d99bbbb`](https://github.com/Alinto/sogo/commit/d99bbbb37ea94603831926cfbb0d9e9a25327123).
`appendSQLToString:withAdaptor:` is provided by SOPE, not by SOGo. The security
backport therefore requires a corresponding SOPE change that was not published.
This most likely affects installations using an SQL user source, since the
changed file is `SQLSource.m`; LDAP-backed installations may be unaffected. That
scoping is inferred from the upstream diff and has not been verified here.
---
## Suggested fix
Either:
1. Publish a matching `sope` / `libsope1` update in esm-apps providing
`-[EOQualifier appendSQLToString:withAdaptor:]`, and tighten the `sogo`
dependency so the pairing is enforced; or
2. Rework the backport so it does not depend on the newer SOPE API.
In either case the current `sogo 5.5.1-1ubuntu0.1~esm1` should be treated as
broken for SQL-user-source installations.
---
## Workaround
Downgrade and hold:
```bash
apt-get install -y --allow-downgrades sogo=5.5.1-1 sogo-common=5.5.1-1
apt-mark hold sogo sogo-common
systemctl restart sogo
```
Verified to restore logins: `POST /SOGo/connect` returns 200 and the mailbox
loads, with a working IMAP connection.
This reintroduces the vulnerabilities fixed by USN-8504-1, including
CVE-2026-46445 and CVE-2026-46446 (SQL injection), so it is a stopgap rather
than a fix.
** Affects: sogo (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162889
Title:
USN-8504-1 regression: sogo 5.5.1-1ubuntu0.1~esm1 breaks all logins on
jammy — calls SOPE API not present in libsope1 5.5.1-1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sogo/+bug/2162889/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
