LoginSign Up
← Back to all sparks
S

SOGo

COLLAB
Velocity0.0

Groupware server with shared calendars, address books and webmail

www.sogo.nu ↗

SOGo's 5.12 line has become a CVE conveyor belt while the team's attention sits on SOGo 6.

groupwarewebmailsecurity-patchingfeature-freezeregression-risk
◆Current state
Six releases in three months, and the majority exist to fix vulnerabilities: XSS via crafted mail, SQL injection, JavaScript injection through hint and theme query parameters, impersonation when OpenID is paired with a non-matching user source, and two CVEs affecting PostgreSQL user sources. Releases 5.12.6 and 5.12.9 exist purely to undo regressions the security fixes introduced.
◆Where it's heading
Alinto declared a feature freeze on 5.12 to concentrate on SOGo 6, and the changelog reflects it — the one new capability in the window, a REST API in 5.12.2, was explicitly a pre-committed sponsored deliverable the team felt obliged to honour. What is left is a hardening cycle on a large groupware surface, with each fix carrying real regression risk into webmail and calendar.
◆Prediction
Expect the 5.12.x line to keep producing security releases with regression follow-ups, and no new functionality until SOGo 6 surfaces.

◆Recent moves

  1. 2mo ago

    Patch undoes 5.12.8 regressions in preferences and mail display

    Fixes preferences that could not be saved, invitation emails rendering wrong, and search results displaying incorrectly — all regressions from the previous security release. The cost of hardening a mature codebase under time pressure.

    View source ↗
  2. 2mo ago

    Two CVEs fixed for PostgreSQL user sources

    Two vulnerabilities affecting deployments with a PostgreSQL user source, with the team unable to pin down when they were introduced and advising that everything below 5.12.7 be treated as affected. Released after 5.12.8, which makes the version ordering confusing for anyone tracking patch levels.

    View source ↗
  3. 2mo ago

    Four vulnerabilities: XSS, SQL injection, OpenID impersonation

    Two XSS paths via malicious mail, one SQL injection, and impersonation when OpenID is used with a non-matching user source. The OpenID one is the serious case — identity confusion in a groupware suite is an authorization failure, not just an input-handling bug.

    View source ↗
  4. 4mo ago

    TOTP silently disabled for new users, now fixed

    New users could configure TOTP successfully and then find two-factor authentication silently disabled on their next login. A regression from 5.12.5 that quietly weakened authentication for anyone onboarded in a three-week window.

    View source ↗
  5. 5mo ago

    Injection fixes in hint queries, theme queries and categories

    Community-reported fixes for JavaScript injection through hint queries, script execution via theme queries, and XSS through event, task and contact categories. The breadth of injection points is a reminder of how much templated user content a groupware UI renders.

    View source ↗
  6. 9mo ago

    Attachments can display above the message body

    The last release in the window that added anything a user would ask for: a preference to show attachments above the mail body, plus fixes to calendar timezone handling and EAS authentication under OpenID. Everything after this is security work.

    View source ↗