UBUNTU-CVE-2026-127121: High severity ubuntu/sogo vulnerability
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of SOGo before 5.12.13 are exposed when they receive a crafted spoofed multipart/signed email. The attacker does not need authentication, but must cause the victim to process the message.
What must an attacker do to exploit it?
The attacker sends a multipart/signed message using an impersonated From address and a CMS signedData object containing the attacker’s self-signed certificate. SOGo stores that certificate on the contact card despite the mismatched or unauthenticated signature.
What is the practical impact after exploitation?
The victim’s contact S/MIME certificate can be replaced with the attacker’s certificate. Later messages encrypted to that contact may be encrypted to the attacker’s key and decrypted using the attacker’s private key.
How can administrators determine whether they may be affected?
Check whether the deployed SOGo version is earlier than 5.12.13. For potentially affected users, inspect contact cards for unexpected S/MIME certificate changes, particularly following suspicious signed messages from impersonated sender addresses.