Package: sogo Version: 5.12.1-3+deb13u2 Severity: important Dear Maintainer,
Since the security update 5.12.1-3+deb13u2 (which backports the fix for CVE-2026-33550), TOTP two-factor authentication can no longer be used when the user source is an SQL (PostgreSQL) source: the secret is stored but is not recognised at login, so 2FA is silently disabled. Environment ----------- - Debian 13 (trixie), sogo 5.12.1-3+deb13u2 - SOGoUserSources: type = sql, PostgreSQL view, canAuthenticate = YES, userPasswordAlgorithm = ssha512 - Profile store: PostgreSQL table sogo_user_profile Steps to reproduce ------------------ 1. In Preferences, tick "Enable two-factor authentication using a TOTP application", scan the QR code, and enter the confirmation code. -> The confirmation code is accepted (setup appears to succeed). 2. Log out, then log in again. Actual result ------------- Instead of being prompted for the TOTP code, the user is shown: "Two-factor authentication has been disabled for your account. Please visit your preferences to restore its use and reconfigure your TOTP application." sogo.log at login shows, on every login: SOGoRootPage New TOTP key for '<user>' must be created Expected result -------------- Subsequent logins should prompt for the TOTP code; 2FA should stay enabled. The secret IS persisted correctly --------------------------------- Inspecting sogo_user_profile for the affected user: - c_defaults contains "SOGoTOTPEnabled":1 - c_settings contains "totpKey" with a value of length 20 (the write path correctly applies the CVE-2026-33550 change from a 12-char to a 20-char secret). So the *write* path stores a valid 20-character key, but the *login/read* path does not recognise it and decides a new key "must be created", which disables 2FA. The enable (write) and login (read) code paths appear to be out of sync — this looks like an incomplete backport of the upstream TOTP fix (5.12.6 / 5.12.7) onto the 5.12.1 base shipped in trixie. Fix availability ---------------- This appears to be already fixed in the upstream 5.12.x line: sogo 5.12.9-1 is currently in testing/unstable and ships the proper upstream TOTP code (rather than a backport onto 5.12.1). This report is therefore mainly a request to have the corrected TOTP handling reach *stable* (trixie) as a point/security update, since stable users on 5.12.1-3+deb13u2 with an SQL user source currently cannot use 2FA at all. Ruled out --------- - Clock: server is NTP-synchronised and at the correct time. - Authenticator app: 1Password and Google Authenticator produce the same code, and the confirmation code is accepted, so the shown secret is valid. - Profile size / truncation: c_defaults is ~3.3 kB; c_defaults and c_settings are TEXT columns (no truncation). - memcached: healthy, zero evictions; issue persists after restarting both sogo and memcached. - A clean disable / restart(sogo + memcached) / re-enable cycle reproduces the problem every time. -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.95+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages sogo depends on: ii adduser 3.152 ii gnustep-base-runtime 1.31.1-3 ii gnustep-multiarch [gnustep-layout-multiarch] 2.9.3-6 ii init-system-helpers 1.69~deb13u1 ii libc6 2.41-12+deb13u3 ii libcrypt1 1:4.4.38-1 ii libcurl4t64 8.14.1-2+deb13u4 ii libgcc-s1 14.2.0-19 ii libglib2.0-0t64 2.84.4-3~deb13u3 ii libgnustep-base1.31 1.31.1-3 ii liblasso3t64 2.8.2-9+deb13u1 ii libmemcached11t64 1.1.4-1.1+b2 ii liboath0t64 2.6.12-1 ii libobjc4 14.2.0-19 ii libsbjson2.3t64 2.3.2-5+b1 ii libsodium23 1.0.18-1+deb13u1 ii libsope1 5.12.1-2 ii libssl3t64 3.5.6-1~deb13u2 ii libytnef0 2.1.2-1+b2 ii libzip5 1.11.3-2 ii memcached 1.6.38-1 ii sogo-common 5.12.1-3+deb13u2 ii systemd 257.13-1~deb13u1 ii sysvinit-utils [lsb-base] 3.14-4 ii zip 3.0-15 sogo recommends no packages. Versions of packages sogo suggests: ii postgresql 17+278 -- Configuration Files: /etc/default/sogo changed: PREFORK=12 /etc/sogo/sogo.conf [Errno 13] Permission non accordée: '/etc/sogo/sogo.conf' -- no debconf information
