Dear Maintainer, Since the security update 5.12.1-3+deb13u2 (which backports the fix for CVE-2026-33550), TOTP two-factor authentication can no longer be used when the user source is an SQL (PostgreSQL) source: the secret is stored but is not recognised at login, so 2FA is silently disabled. Environment ----------- - Debian 13 (trixie), sogo 5.12.1-3+deb13u2 - SOGoUserSources: type = sql, PostgreSQL view, canAuthenticate = YES, userPasswordAlgorithm = ssha512 - Profile store: PostgreSQL table sogo_user_profile Steps to reproduce ------------------ 1. In Preferences, tick "Enable two-factor authentication using a TOTP application", scan the QR code, and enter the confirmation code. -> The confirmation code is accepted (setup appears to succeed). 2. Log out, then log in again. Actual result ------------- Instead of being prompted for the TOTP code, the user is shown: "Two-factor authentication has been disabled for your account. Please visit your preferences to restore its use and reconfigure your TOTP application." sogo.log at login shows, on every login: SOGoRootPage New TOTP key for '<user>' must be created Expected result -------------- Subsequent logins should prompt for the TOTP code; 2FA should stay enabled. The secret IS persisted correctly --------------------------------- Inspecting sogo_user_profile for the affected user: - c_defaults contains "SOGoTOTPEnabled":1 - c_settings contains "totpKey" with a value of length 20 (the write path correctly applies the CVE-2026-33550 change from a 12-char to a 20-char secret). So the *write* path stores a valid 20-character key, but the *login/read* path does not recognise it and decides a new key "must be created", which disables 2FA. The enable (write) and login (read) code paths appear to be out of sync — this looks like an incomplete backport of the upstream TOTP fix (5.12.6 / 5.12.7) onto the 5.12.1 base shipped in trixie. Fix availability ---------------- This appears to be already fixed in the upstream 5.12.x line: sogo 5.12.9-1 is currently in testing/unstable and ships the proper upstream TOTP code (rather than a backport onto 5.12.1). This report is therefore mainly a request to have the corrected TOTP handling reach *stable* (trixie) as a point/security update, since stable users on 5.12.1-3+deb13u2 with an SQL user source currently cannot use 2FA at all. Ruled out --------- - Clock: server is NTP-synchronised and at the correct time. - Authenticator app: 1Password and Google Authenticator produce the same code, and the confirmation code is accepted, so the shown secret is valid. - Profile size / truncation: c_defaults is ~3.3 kB; c_defaults and c_settings are TEXT columns (no truncation). - memcached: healthy, zero evictions; issue persists after restarting both sogo and memcached. - A clean disable / restart(sogo + memcached) / re-enable cycle reproduces the problem every time.
Hi Ben, thanks for your report. I am sorry about that. I prepared a patch that hopefully fixes this: https://salsa.debian.org/wiene/sogo/-/commits/trixie-pending (corresponding debdiff is attached). It integrates upstream commit [0]. Ben, do you have an opportunity to test whether this actually fixes the issue for you? You can find debs including the patch on [1]. @Security team: Do you think this justifies a regression update for DSA 6366-1? Best regards Peter [0] https://github.com/Alinto/sogo/commit/623f083cd94842766c6d9430cf3bdad8fc4d5dbc [1] https://people.debian.org/~wiene/debs/
Hi Peter, Thank you for the very quick turnaround. No need to apologise at all. I tested your patched packages (sogo, sogo-common and sogo-activesync 5.12.1-3+deb13u3 from people.debian.org/~wiene/debs/) on the same production system that originally exhibited the bug (Debian 13 trixie, SQL/PostgreSQL user source). It fixes the issue. After enabling TOTP and confirming the code, logging out and back in now correctly prompts for the TOTP code, and 2FA stays enabled across repeated login cycles. The "SOGoRootPage New TOTP key ... must be created" line no longer appears in sogo.log. I confirmed it over several enable / logout / login cycles. So from my side this is fully resolved. Thanks especially for taking the time to look into this in the middle of August, when most people are on holiday. Much appreciated. It would be great to see this reach stable (and bookworm) as a regression update. Best regards, Ben Le Samedi 15 Août 2026 13:30 CEST, Peter Wienemann <wiene@debian.org> a écrit: Control: tags -1 + security trixie bookworm fixed-upstream patch Hi Ben, thanks for your report. I am sorry about that. I prepared a patch that hopefully fixes this: https://salsa.debian.org/wiene/sogo/-/commits/trixie-pending (corresponding debdiff is attached). It integrates upstream commit [0]. Ben, do you have an opportunity to test whether this actually fixes the issue for you? You can find debs including the patch on [1]. @Security team: Do you think this justifies a regression update for DSA 6366-1? Best regards Peter [0] https://github.com/Alinto/sogo/commit/623f083cd94842766c6d9430cf3bdad8fc4d5dbc [1] https://people.debian.org/~wiene/debs/
Hi Peter, Let's fix this via a regression update to the DSA. Can you plese upload to security-master? Regards, Salvatore
We believe that the bug you reported is fixed in the latest version of
sogo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142810@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Peter Wienemann <wiene@debian.org> (supplier of updated sogo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Architecture: source
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Closes: 1142810 1148454
Changes:
sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
.
* Non-maintainer upload.
* Add patch to fix a regression introduced by fix for CVE-2026-33550
(Closes: #1142810)
* Add patch to fix shell injection by disabling sendmail
* Add patch to fix SQL injection: properly parse MKCOL request
* Add patch to fix XSS: escape angularJS directive for description
* Add patch to add stripAngular to stringWithoutHTMLInjection calls
This is a follow-up change to the XSS fix escaping angularJS directive.
* Add patch to fix SSRF: do not transmit og http status to external calendar
* Add patch to fix CVE-2026-93453: password reset poisoning
(Closes: 1148454)
* Add patch to fix XSS: use legitimate sorting value
* Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc
4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Checksums-Sha256:
0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439 sogo_5.12.1-3+deb13u3.dsc
7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Files:
680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc
ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional sogo_5.12.1-3+deb13u3.debian.tar.xz
bd83aad074acf70f53613808082d45f7 14842 mail optional sogo_5.12.1-3+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2
QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF
LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS
YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a
hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr
WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh
rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs
aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR
wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8
n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18
yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb
+wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8
1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=
=YPWx
-----END PGP SIGNATURE-----