From foo@bar  Thu Oct 15 00:40:01 2026
Format: 1.8
Date: Wed, 14 Oct 2026 23:08:12 +0200
Source: sogo
Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym
Architecture: hurd-i386
Version: 5.12.12-1
Distribution: sid
Urgency: medium
Maintainer: Debian GNU/Hurd Build Daemon <buildd_hurd-i386-mahler@buildd.debian.org>
Changed-By: Jordi Mallach <jordi@debian.org>
Description:
 sogo       - Scalable groupware server
 sogo-activesync - Scalable groupware server - ActiveSync module
Changes:
 sogo (5.12.12-1) unstable; urgency=medium
 .
   * New upstream release with security bugfixes:
     - IDOR in the contact search endpoint
     - possible header injection through generated Message-Id domains
   * Cherry-pick upstream security fixes from master:
     - session_key_base64_check.patch: possible SQL injection via session key
     - draft_path_traversal.patch: path traversal through draft names
     - bydaymask_buffer_overflow.patch: stack overflow parsing BYDAY rules
     - ldap_filter_escaping.patch: LDAP filter injection
   * Update source lintian overrides for CKEditor 5 and long lines.
   * Do not ship the CKEditor sample page and build files.
   * Drop dependency on obsolete lsb-base.
   * Do not recursively change log and spool directory permissions in postinst.
   * Do not activate the ldconfig trigger for private libraries.
   * Override lintian tags for bundled Material Icons font and CKEditor 5.
   * Add DEP-3 headers to patches missing a description.
   * Drop disable_isIpv4_test.patch, fixed upstream, and refresh the rest.
   * Fix removal of unvendored angular modules, brace expansion needs bash.
   * Override privacy-breach-generic for CKEditor embeds and angular-material docs.
   * Update copyright for CKEditor 5.
   * Move arch-dependent API bundle from sogo-common to sogo.
   * Add missing "New upstream release" entry to previous entry.
   * Document security fixes and CVE ids in previous entries.
Checksums-Sha1:
 b9aceb296e47b73ee527ec9c5173b15ab1790f3b 103576 sogo-activesync-dbgsym_5.12.12-1_hurd-i386.deb
 01117f214a8adcc04fd21d7a6de0eae67f51ed6c 224416 sogo-activesync_5.12.12-1_hurd-i386.deb
 c0dd9fe4fbd92e359a7e53a94af1a8f1b6160e66 1223356 sogo-dbgsym_5.12.12-1_hurd-i386.deb
 6f77537608e24d25de450f057f7f500de76622ca 13222 sogo_5.12.12-1_hurd-i386.buildinfo
 b001f3977b59b6eaf84e4282db2ad8c31f8a81c2 1197916 sogo_5.12.12-1_hurd-i386.deb
Checksums-Sha256:
 c320807b19362fbd810eb804a1191a586646d8fda1b65ae4c8d16fea91ed8980 103576 sogo-activesync-dbgsym_5.12.12-1_hurd-i386.deb
 d2e1b18aa5160873898daec9db785e8436f9cd2ae8156218aaf3cff45492a61c 224416 sogo-activesync_5.12.12-1_hurd-i386.deb
 d781eb4bb73940acb677c537abcc1d39d8af5a5ad63b758cfadca7c917163283 1223356 sogo-dbgsym_5.12.12-1_hurd-i386.deb
 85dd3d4d8f3e356e00624cbd5fdac6a839bdba5125e39e7d65f26780bef9bd99 13222 sogo_5.12.12-1_hurd-i386.buildinfo
 7b572ce72d32ef6cfe7f7e8e534976fc92a13d1e41edb12bb7dc76bcf5c9ed2e 1197916 sogo_5.12.12-1_hurd-i386.deb
Files:
 9d31e72bafeb3ea085f79d2a5795484a 103576 debug optional sogo-activesync-dbgsym_5.12.12-1_hurd-i386.deb
 3b31fbe35fc673793ee9d6c77eb13a52 224416 mail optional sogo-activesync_5.12.12-1_hurd-i386.deb
 8003d9f66d6e21adbac3b88814b62131 1223356 debug optional sogo-dbgsym_5.12.12-1_hurd-i386.deb
 49ee6ef24e59c96010c31dd6556144ad 13222 mail optional sogo_5.12.12-1_hurd-i386.buildinfo
 fa3887f97d98a354d4b5f742d1678a8c 1197916 mail optional sogo_5.12.12-1_hurd-i386.deb
Signed-By: buildd autosigning key mahler <buildd_hurd-i386-mahler@buildd.debian.org>