SOGo OTP Renewal Vulnerability and Short Key Length Issue

A vulnerability exists in SOGo versions prior to 5.12.5, where the One-Time Password (OTP) is not properly renewed when a user disables and re-enables it. Additionally, the OTP key length is insufficient, consisting of only 12 digits instead of the recommended 20.

Impact

Failure to properly renew the OTP can lead to authentication issues, where the old OTP may still be considered valid, potentially allowing unauthorized access. The short key length could weaken the OTP's security, making it more susceptible to brute-force attacks.

Reproduction

In SOGo versions prior to 5.12.5, disable the OTP feature and then re-enable it. The OTP will not be renewed. Additionally, the OTP key can be checked, which will reveal that it is only 12 digits long.

Remediation

Users can upgrade to SOGo version 5.12.5 or later, where this vulnerability has been addressed.