Ubuntu alert USN-8504-1 (sogo)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8504-1] SOGo vulnerabilities | |
| Date: | Mon, 06 Jul 2026 13:16:10 +0000 | |
| Message-ID: | <E1wgjBC-0002L4-UQ@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8504-1 July 05, 2026 sogo vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in SOGo. Software Description: - sogo: Open Source Webmail for businesses and communities Details: It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-71276) It was discovered that SOGo did not properly sanitize the hint query parameter. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3054) It was discovered that SOGo did not renew the one-time password when a user disabled and re-enabled it, and used a shorter length than recommended. A remote attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33550) It was discovered that SOGo did not properly use the SQL adaptor for the user source, resulting in SQL injection when certain databases were used. A remote authenticated attacker could possibly use this issue to obtain sensitive information or execute arbitrary SQL commands. (CVE-2026-46445, CVE-2026-46446) It was discovered that SOGo did not properly sanitize mail containing ICS calendar invitations. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-8496) It was discovered that SOGo did not properly validate identifiers when managing access control lists. A remote authenticated attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information. (CVE-2026-8851) It was discovered that SOGo did not properly sanitize the theme parameter. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499) It was discovered that SOGo did not properly sanitize the userName parameter on the login page. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63498) It was discovered that SOGo did not properly sanitize attachments when previewing them. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-34462) It was discovered that SOGo did not validate the signatures of SAML assertions it received when SAML was used for authentication. A remote attacker could possibly use this issue to impersonate other users. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-33054) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS sogo 5.12.4-1.2ubuntu0.1~esm1 Available with Ubuntu Pro sogo-activesync 5.12.4-1.2ubuntu0.1~esm1 Available with Ubuntu Pro sogo-common 5.12.4-1.2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS sogo 5.5.1-1ubuntu0.1~esm1 Available with Ubuntu Pro sogo-activesync 5.5.1-1ubuntu0.1~esm1 Available with Ubuntu Pro sogo-common 5.5.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS sogo 4.3.0-1ubuntu0.1~esm1 Available with Ubuntu Pro sogo-common 4.3.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS sogo 3.2.10-1ubuntu0.1~esm1 Available with Ubuntu Pro sogo-common 3.2.10-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS sogo 2.2.17a-1.1ubuntu0.1~esm1 Available with Ubuntu Pro sogo-common 2.2.17a-1.1ubuntu0.1~esm1 Available with Ubuntu Pro After a standard system update you need to restart SOGo to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8504-1 CVE-2021-33054, CVE-2024-34462, CVE-2025-63498, CVE-2025-63499, CVE-2025-71276, CVE-2026-3054, CVE-2026-33550, CVE-2026-46445, CVE-2026-46446, CVE-2026-8496, CVE-2026-8851
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpLqf8ACgkQcpJm3tlz hgHg1Q//TSTra9UtulTXa2jkBp66xgmxFn0FljhqNuVD/O5htLj0WMVWcpYscgOS BBYJZlXlmR1i5YcQ8Thur6cY1yQpQcMjjKaHgz1tzcZC+VhMwxKxbEfE7GIxIl3k hGpvJTekeOiUSDvqrH6MVEjVXzOxdAmF9wX2uFpNwwztfyCBNYpmmblXg13wcZNr 1P46pYhEPWk9Ax0nkTW5inzyg2hT08fVed/P9X/Sh6OB8ciBxFE2b7p2gFjSyLgY CPi0DZgrEz75mbdQqXo9Ob7e+Qgvi9nn1vjoLy9hAZkNWabEMo4dTSpx2EskBbel mQNNONUSZtFqFSrUSqXf1jpxI2hjtY8oxNnGSjWqQ8NS6Jq+HDON1ngajjrgSq1g CbDpo9lThHaVxaviIFb0I/QuSO5yR5bo6GvyCkkDijXNniuSO8k76Ayr/t7ou8ZO 9R2GWNWZrleTgozBOJno5dt0dG9bx55n6cYufehTgyb6QR3p1OTU2wxsKwBCYUvl BU7074HP50dTEc3JnWdc/K/IVczsMepzapuMiHvX8gAx5Wh3G35GsvmbVtOQoZ3K NqjrK98r/4jMDtT9C1hmChJtoiump1UJi/9OZZQQmtmyGZ74aXcaWPPXlCNKApQA gfNckqUifB5i4YGd2FxIeQacd5/7Q+jDOHgzSrrsQcSrXjUdx6g= =jCBQ -----END PGP SIGNATURE-----