Vulnerable: version 2.4.3nb6 is affected by 11 known vulnerabilities. See below.
www/SOGo 2.4.3nb6 NetBSD
Groupware server supporting CalDAV, CardDAV and GroupDAV
- System
- NetBSD
- Repository
- pkgsrc
- Maintainer
- [email protected]
- License
- gnu-gpl-v2
- Categories
- www
- Package size
- 3851.0 KiB, 22685.4 KiB installed
Description
SOGo is fully supported and trusted groupware server with a focus on scalability and open standards. SOGo is released under the GNU GPL/LGPL v2 and above.
SOGo provides a rich AJAX-based Web interface and supports multiple native clients through the use of standard protocols such as CalDAV, CardDAV and GroupDAV.
SOGo is the missing component of your infrastructure; it sits in the middle of your servers to offer your users an uniform and complete interface to access their information. It has been deployed in production environments where thousands of users are involved.
This is SOGo 2. (What are the differences between version 2 and 5? Version 5 has a modern, fully responsive Web frontend. Version 2 is not responsive and has an aging design. Both versions 2 and 5 share a common implementation of the communication protocols supported in SOGo and SOPE: LDAP, IMAP, SQL, CardDAV, CalDAV, and Microsoft Enterprise ActiveSync.)
Install
Binary package:
pkgin install SOGo
From pkgsrc:
cd /usr/pkgsrc/www/SOGo && make install clean
Packages
The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.
| Repository | Version |
|---|---|
| NetBSD 10.1 x86_64 | 2.4.3nb6 |
| NetBSD 10.1 aarch64 | 2.4.3nb6 |
| SmartOS / illumos x86_64 | - |
| macOS 15 arm64 | - |
Dependencies
Run dependencies 8
No port depends on this one.
Known vulnerabilities 11
- SOGo: code-injection (CVE-2016-6191)
- SOGo: cross-site-request-forgery (CVE-2015-5395)
- SOGo: cross-site-scripting (CVE-2022-4556)
- SOGo: cross-site-scripting (CVE-2022-4558)
- SOGo: authorization-bypass (CVE-2025-50340)
- SOGo: cross-site-scripting (CVE-2025-63498)
- SOGo: cross-site-scripting (CVE-2025-63499)
- SOGo: cross-site-scripting (CVE-2025-71276)
- SOGo: cross-site-scripting (CVE-2026-3054)
- SOGo: security-bypass (CVE-2026-33550)
- SOGo: denial-of-service (CVE-2016-6188)