Dear Maintainer,

after updating 'php-horde-turba' on my buster-system to the latest
security patch, my users can no longer log into the horde webmail
interface.
instead they are greeted with an error message after authentication:

```
A fatal error has occurred
$name must be a string
in /usr/share/php/Horde/Registry.php:1679

 1. Horde_Registry::appInit() /usr/share/horde/imp/index.php:19
 2. Horde_Registry->pushApp() /usr/share/php/Horde/Registry.php:298
 3. Horde_Registry->_pushAppError() /usr/share/php/Horde/Registry.php:1622
 4. Horde_Registry::appInit() /usr/share/horde/imp/index.php:19
 5. Horde_Registry->pushApp() /usr/share/php/Horde/Registry.php:298
 6. Horde_Registry->callAppMethod() /usr/share/php/Horde/Registry.php:1617
 7. Horde_Registry_Application->authenticated() /usr/share/php/Horde/Registry.php:1197
 8. IMP_Application->_authenticated() /usr/share/php/Horde/Registry/Application.php:108
 9. IMP_Auth::authenticateCallback() /usr/share/horde/imp/lib/Application.php:134
10. IMP_Imap->doPostLoginTasks() /usr/share/horde/imp/lib/Auth.php:243
11. IMP_Imap->updateFetchIgnore() /usr/share/horde/imp/lib/Imap.php:344
12. IMP_Mailbox::getSpecialMailboxes() /usr/share/horde/imp/lib/Imap.php:354
13. IMP_Mailbox_SessionCache->getSpecialMailboxes() /usr/share/horde/imp/lib/Mailbox.php:1364
14. IMP_Mailbox::getPref() /usr/share/horde/imp/lib/Mailbox/SessionCache.php:268
15. Horde_Prefs->getValue() /usr/share/horde/imp/lib/Mailbox.php:235
16. Horde_Prefs->_getScope() /usr/share/php/Horde/Prefs.php:304
17. Horde_Prefs->_loadScope() /usr/share/php/Horde/Prefs.php:397
18. Horde_Core_Prefs_Storage_Hooks->get() /usr/share/php/Horde/Prefs.php:467
19. Horde_Core_Hooks->callHook() /usr/share/php/Horde/Core/Prefs/Storage/Hooks.php:39
20. IMP_Hooks->prefs_init() /usr/share/php/Horde/Core/Hooks.php:61
21. Horde_Registry->call() /etc/horde/imp/hooks.php:29
22. Horde_Registry->callByPackage() /usr/share/php/Horde/Registry.php:1089
23. Horde_Registry->pushApp() /usr/share/php/Horde/Registry.php:1128
24. Horde_Registry->_pushAppError() /usr/share/php/Horde/Registry.php:1640
25. Horde_Registry::appInit() /usr/share/horde/imp/index.php:19
26. Horde_Registry->pushApp() /usr/share/php/Horde/Registry.php:298
27. Horde_Registry->callAppMethod() /usr/share/php/Horde/Registry.php:1617
28. Horde_Registry_Application->authenticated() /usr/share/php/Horde/Registry.php:1197
29. IMP_Application->_authenticated() /usr/share/php/Horde/Registry/Application.php:108
30. IMP_Auth::authenticateCallback() /usr/share/horde/imp/lib/Application.php:134
31. IMP_Imap->doPostLoginTasks() /usr/share/horde/imp/lib/Auth.php:243
32. IMP_Imap->updateFetchIgnore() /usr/share/horde/imp/lib/Imap.php:344
33. IMP_Mailbox::getSpecialMailboxes() /usr/share/horde/imp/lib/Imap.php:354
34. IMP_Mailbox_SessionCache->getSpecialMailboxes() /usr/share/horde/imp/lib/Mailbox.php:1364
35. IMP_Mailbox::getPref() /usr/share/horde/imp/lib/Mailbox/SessionCache.php:268
36. Horde_Prefs->getValue() /usr/share/horde/imp/lib/Mailbox.php:235
37. Horde_Prefs->_getScope() /usr/share/php/Horde/Prefs.php:304
38. Horde_Prefs->_loadScope() /usr/share/php/Horde/Prefs.php:397
39. Horde_Core_Prefs_Storage_Hooks->get() /usr/share/php/Horde/Prefs.php:467
40. Horde_Core_Hooks->callHook() /usr/share/php/Horde/Core/Prefs/Storage/Hooks.php:39
41. IMP_Hooks->prefs_init() /usr/share/php/Horde/Core/Hooks.php:61
42. Horde_Registry->call() /etc/horde/imp/hooks.php:29
43. Horde_Registry->callByPackage() /usr/share/php/Horde/Registry.php:1089
44. Horde_Registry->pushApp() /usr/share/php/Horde/Registry.php:1128
45. Horde_Registry->callAppMethod() /usr/share/php/Horde/Registry.php:1635
46. Horde_Registry_Application->init() /usr/share/php/Horde/Registry.php:1197
47. Turba_Application->_init() /usr/share/php/Horde/Registry/Application.php:117
48. Turba::permissionsFilter() /usr/share/horde/turba/lib/Application.php:122
49. Turba_Factory_Driver->createFromConfig() /usr/share/horde/turba/lib/Turba.php:434
50. Turba_Factory_Driver->_create() /usr/share/horde/turba/lib/Factory/Driver.php:64
51. Turba_Driver_Share->__construct() /usr/share/horde/turba/lib/Factory/Driver.php:141
52. Turba_Factory_Driver->create() /usr/share/horde/turba/lib/Driver/Share.php:47
```

downgrading to 4.2.23-1 fixes the issue (but of course this is somewhat
suboptimal, giving the nature of security-upgrades).

Hi,

we see exactly the same issue. Going back to 4.2.23-1 fixed the issue
for now, but as already stated this opens the security hole again.

Thanks for fixing,

Christopher

Apparently in
/usr/share/horde/turba/lib/Driver/Share.php:47
the change from create to createFromConfig is missing.

If changed manually it seems to work like intended

Regards,
Sebastian

The aforementioned mentioned security update would be
DLA-3090-1
https://lists.debian.org/debian-lts-announce/2022/08/msg00022.html

Sadly we didn't see the bug at that time, adding Cc:
debian-lts@lists.debian.org helps.

It's now part of the (non-Debian) ELTS offering, so it would be worth
fixing there.

The upstream fix appears to be:
https://github.com/horde/turba/commit/bc53d856ca87656cdc6e5fafd54f2360eb247e24
(v4.2.26)
https://github.com/horde/turba/commit/0d1e74802dd2ff8758c5b1dd5323a0101d49897d
(v5.0.0alpha6)

The "createFromConfig" call is present in 4.2.29-1 in Debian, marking it
as fixed there.

Cheers!
Sylvain Beucler
Debian LTS Team

Hello,

Bug #1019153 in php-horde-turba reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/horde-team/php-horde-turba/-/commit/be41720fdd3eeff0f65e69001b5614bbcaea96c2
------------------------------------------------------------------------
Import Debian changes 4.2.23-1+deb10u2

php-horde-turba (4.2.23-1+deb10u2) buster-security; urgency=high
.
  * Non-maintainer upload by the ELTS Security Team.
  * CVE-2022-30287: redo patch from 4.2.x commits (Closes: #1019153)
  * Update Salsa-CI configuation.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1019153

Hello,

Bug #1019153 in php-horde-turba reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/horde-team/php-horde-turba/-/commit/105644a811a79dc767d34fe4fc9bb12fa1e99fd8
------------------------------------------------------------------------
Import Debian changes 4.2.23-1+deb10u2

php-horde-turba (4.2.23-1+deb10u2) buster-security; urgency=high
.
  * Non-maintainer upload by the ELTS Security Team.
  * CVE-2022-30287: redo patch from 4.2.x commits (Closes: #1019153)
  * Update Salsa-CI configuation.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1019153

Hello,

Bug #1019153 in php-horde-turba reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/horde-team/php-horde-turba/-/commit/4c8400d4acc1eb28b0ade50c601f8f3282c58eb9
------------------------------------------------------------------------
Import Debian changes 4.2.23-1+deb10u2

php-horde-turba (4.2.23-1+deb10u2) buster-security; urgency=high
.
  * Non-maintainer upload by the ELTS Security Team.
  * CVE-2022-30287: redo patch from 4.2.x commits (Closes: #1019153)
  * Update Salsa-CI configuation.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1019153