SOGo SQL Injection Fix Patch for PostgreSQL Clear-Text Passwords

Bug#1136070: trixie-pu: package sogod/5.12.1-3+deb13u2 Vulnerability Overview Package: sogod (version 5.12.1-3+deb13u2) Vulnerability Type: SQL injection vulnerability Trigger Conditions: Occurs when the user source is a PostgreSQL database and passwords are stored in plaintext. Severity: Normal Upstream Fix: This vulnerability was fixed in upstream version 5.12.7. Debian maintainer Peter Wiemann believes the upstream patch is sufficient to address the issue, although he did not fully understand all code details; the patch appears to target SQL injection in the credential handling section. Impact Scope Affected Environments: 1. At least one user source is a PostgreSQL database. 2. At least one user source is an SQL database (MariaDB or PostgreSQL) with passwords stored in plaintext. Risk: Attackers may execute arbitrary SQL commands during credential processing by crafting malicious input. Testing Status: The maintainer stated that running upstream version 5.12.7 in production for several weeks revealed no issues, but since their user sources are LDAP rather than SQL databases, the testing value is limited. Remediation Fixed Version: Upgrade the package from 5.12.1-3 to 5.12.1-3+deb13u2. Fix Method: Apply the upstream cherry-picked patch . Patch Content: The patch modifies the file to ensure proper escaping and validation of user input when using the SQL adapter, preventing SQL injection. Additional Notes: The maintainer does not plan to backport this fix to version 5.8.0 because the upstream fix cannot be directly applied to that older version. The patch is documented in the changelog and has been reviewed and approved. POC/Exploit Code (from patch diff) The following are key security fix code snippets extracted from the patch, demonstrating how passwords and login fields are properly handled to prevent SQL injection: Note: The above code block extracts key security fix portions from the patch diff, showing how input is escaped and processed to prevent SQL injection. The complete patch file contains more context and changes.

Goal Reached Thanks to every supporter — we hit 100%!

SOGo SQL Injection Fix Patch for PostgreSQL Clear-Text Passwords