Skip to content

SOGo v5.12.10

Latest
Latest

Choose a tag to compare

View all tags
@QHivert QHivert released this 13 Aug 15:51
SOGo-5.12.10
f7fce46

The Alinto team is pleased to announce the immediate availability of SOGo v5.12.10. This is a major release as it fixes security vulnerabilities.

IMPORTANT

Four major vulnerabilities have been reported and fixed in this version 5.12.10 or since the nightly of the 12th of May 2026: sogo_5.12.9.20260810.

Those vulnerabilities affect any previous SOGO version. Please update as soon as possible

CVE ID will be updated once they're created

  • 1 possible SQL injection with specific request -> fixed
  • Several possible XSS injections with malicious mail -> fixed
  • 1 possible SSRF with specific request -> fixed
  • 1 possible shell injection when using sendmail -> sendmail disabled

Sendmail

Sendmail has been disabled in this version as the fix would be to completely redo this part. Plus, we're not sure if anyone use sendmail over smtp. If that the case, let us know and we may readd sendmail fixed in a future version.

Thanks

Thanks to the reporter of vulnerabilities:

Regression

Display

Due to the XSS injection fix, webmail display may be affected. If that's the case, please report a bug https://bugs.sogo.nu

Event/calendar import

SOGo now clean the event organizer, attendees and generate a new UID. That prevent user to import legitimate or illegitimate events that will affect the original,
or send IMIP messages to attendees.

Others fixes

Features

  • sogo-tool: add init-user command to create a user's personal folders and preferences without a login (aefc14b)

Bug Fixes

  • bug: escape angularJS only if needed to keep legitimate directive (41e2b7b)
  • bug: incorrect method called (1caa257)
  • calendar: do not transmit og http status to external calendar (3a78a3b)
  • ckeditor: Sync resized image width/height into style and HTML attributes so Outlook and other mail clients ignoring CSS aspect-ratio render the correct dimensions. Closes #6169. (39a3583)
  • dav: properly parse MKCOL request (78807d0)
  • event: clean import of event (b5c83f5)
  • event: clean import of event (b18f1a0)
  • mail: escape angularJS directive for description (47133fd)
  • mail: escape References/Organization/Newsgroups headers in HTML forward so message-id chevrons aren't parsed as HTML tags hiding the quoted body. Closes #6046. (f11f34c)
  • mail: Some links broken in HTML rendering due to libxml2 (SOPE) only supporting HTML4 — when an anchor has no content between its opening and closing tags, store it and re-open it around the next element, closing after that element's end tag. Closes #5961. Closes #6172. (6904911)
  • passwordRecoveyr: get the domain from the user mail (a156f4c)
  • tool: wrong method called (97bbd7e)

Localization

  • hu: Update Hungarian translations (2a8f20e)

See the complete change log.

Assets 2
Loading