Fix CVE-2026-2604

- Update to version 3.56.2:
  + Bug Fixes:
    - Handle changed server pool in WebDAV collection sources ][
    - CamelDataWrapper: Correct return value of size calculate
      functions
    - GOA EWS: Fallback to likely EWS host URL when autodicovery
      fails (forwarded request 1279662 from iznogood)

OBS-URL: https://build.opensuse.org/request/show/1280042
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/evolution-data-server?expand=0&rev=266

_service

@@ -3,7 +3,7 @@
   <service name="obs_scm" mode="manual">
     <param name="scm">git</param>
     <param name="url">https://gitlab.gnome.org/GNOME/evolution-data-server.git</param>
-    <param name="revision">3.52.4</param>
+    <param name="revision">3.56.2</param>
     <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
     <param name="versionrewrite-pattern">(.*)\+0</param>
     <param name="versionrewrite-replacement">\1</param>

eds-CVE-2026-2604.patch

@@ -0,0 +1,172 @@
+From afa12b6ba502e5acaa431415aa3b939ddb377382 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Mon, 16 Feb 2026 18:20:34 +0100
+Subject: [PATCH] I#627 - Canonicalize path before local cache file removal
+
+Closes https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
+---
+ .../backends/file/e-book-backend-file.c       |  2 +-
+ .../libedata-book/e-book-meta-backend.c       |  2 +-
+ src/calendar/libedata-cal/e-cal-cache.c       |  2 +-
+ src/libedataserver/e-data-server-util.c       | 42 ++++++++++++++++++
+ src/libedataserver/e-data-server-util.h       |  2 +
+ tests/libedataserver/libedataserver-test.c    | 43 +++++++++++++++++++
+ 6 files changed, 90 insertions(+), 3 deletions(-)
+
+diff -urp evolution-data-server-3.58.3.orig/src/addressbook/backends/file/e-book-backend-file.c evolution-data-server-3.58.3/src/addressbook/backends/file/e-book-backend-file.c
+--- evolution-data-server-3.58.3.orig/src/addressbook/backends/file/e-book-backend-file.c	2026-02-23 13:52:32.688903333 -0600
++++ evolution-data-server-3.58.3/src/addressbook/backends/file/e-book-backend-file.c	2026-02-23 14:07:47.807663557 -0600
+@@ -392,7 +392,7 @@ maybe_delete_uri (EBookBackendFile *bf,
+ 	/* If the file is in our path it belongs to us and we need to delete it.
+ 	 */
+ 	if (bf->priv->photo_dirname &&
+-	    !strncmp (bf->priv->photo_dirname, filename, strlen (bf->priv->photo_dirname))) {
++	    e_util_filename_is_in_path (filename, bf->priv->photo_dirname)) {
+ 
+ 		d (g_print ("Deleting uri file: %s\n", filename));
+ 
+diff -urp evolution-data-server-3.58.3.orig/src/addressbook/libedata-book/e-book-meta-backend.c evolution-data-server-3.58.3/src/addressbook/libedata-book/e-book-meta-backend.c
+--- evolution-data-server-3.58.3.orig/src/addressbook/libedata-book/e-book-meta-backend.c	2026-02-23 13:52:32.702903481 -0600
++++ evolution-data-server-3.58.3/src/addressbook/libedata-book/e-book-meta-backend.c	2026-02-23 14:07:47.808137174 -0600
+@@ -586,7 +586,7 @@ ebmb_gather_photos_local_filenames (EBoo
+ 				gchar *filename;
+ 
+ 				filename = g_filename_from_uri (url, NULL, NULL);
+-				if (filename && g_str_has_prefix (filename, cache_path))
++				if (filename && e_util_filename_is_in_path (filename, cache_path))
+ 					filenames = g_slist_prepend (filenames, filename);
+ 				else
+ 					g_free (filename);
+diff -urp evolution-data-server-3.58.3.orig/src/calendar/libedata-cal/e-cal-cache.c evolution-data-server-3.58.3/src/calendar/libedata-cal/e-cal-cache.c
+--- evolution-data-server-3.58.3.orig/src/calendar/libedata-cal/e-cal-cache.c	2026-02-23 13:52:32.722903693 -0600
++++ evolution-data-server-3.58.3/src/calendar/libedata-cal/e-cal-cache.c	2026-02-23 14:07:47.808526161 -0600
+@@ -3707,7 +3707,7 @@ e_cal_cache_delete_attachments (ECalCach
+ 						if (!cache_dirname)
+ 							cache_dirname = g_path_get_dirname (e_cache_get_filename (E_CACHE (cal_cache)));
+ 
+-						if (g_str_has_prefix (filename, cache_dirname) &&
++						if (e_util_filename_is_in_path (filename, cache_dirname) &&
+ 						    g_unlink (filename) == -1) {
+ 							/* Ignore these errors */
+ 						}
+diff -urp evolution-data-server-3.58.3.orig/src/libedataserver/e-data-server-util.c evolution-data-server-3.58.3/src/libedataserver/e-data-server-util.c
+--- evolution-data-server-3.58.3.orig/src/libedataserver/e-data-server-util.c	2026-02-23 13:52:32.784904350 -0600
++++ evolution-data-server-3.58.3/src/libedataserver/e-data-server-util.c	2026-02-23 14:07:47.809739409 -0600
+@@ -3152,3 +3152,45 @@ e_util_guess_source_is_readonly	(ESource
+ 
+ 	return res;
+ }
++
++/**
++ * e_util_filename_is_in_path:
++ * @filename: a filename
++ * @path: an expected path
++ *
++ * Checks whether the @filename is stored under @path.
++ * It use canonicalized form of the paths before comparing them.
++ * Both the @filename and @path are expected to be absolute paths,
++ * is not, %FALSE is returned.
++ *
++ * Returns: whether the @filename is stored under @path
++ *
++ * Since: 3.60
++ **/
++gboolean
++e_util_filename_is_in_path (const gchar *filename,
++			    const gchar *path)
++{
++	gchar *canon_filename, *canon_path;
++	gsize path_len;
++	gboolean res;
++
++	g_return_val_if_fail (filename != NULL, FALSE);
++	g_return_val_if_fail (path != NULL, FALSE);
++
++	if (!g_path_is_absolute (filename) ||
++	    !g_path_is_absolute (path))
++		return FALSE;
++
++	canon_filename = g_canonicalize_filename (filename, NULL);
++	canon_path = g_canonicalize_filename (path, NULL);
++	path_len = strlen (canon_path);
++
++	res = path_len > 0 && g_str_has_prefix (canon_filename, canon_path) &&
++		canon_filename[path_len] == G_DIR_SEPARATOR;
++
++	g_free (canon_filename);
++	g_free (canon_path);
++
++	return res;
++}
+diff -urp evolution-data-server-3.58.3.orig/src/libedataserver/e-data-server-util.h evolution-data-server-3.58.3/src/libedataserver/e-data-server-util.h
+--- evolution-data-server-3.58.3.orig/src/libedataserver/e-data-server-util.h	2026-02-23 13:52:32.784904350 -0600
++++ evolution-data-server-3.58.3/src/libedataserver/e-data-server-util.h	2026-02-23 14:09:07.455490246 -0600
+@@ -265,6 +265,8 @@ void		e_util_change_uri_port		(GUri **in
+ 						 gint port);
+ void		e_util_call_malloc_trim		(void);
+ gboolean	e_util_guess_source_is_readonly	(struct _ESource *source);
++gboolean	e_util_filename_is_in_path	(const gchar *filename,
++						 const gchar *path);
+ 
+ G_END_DECLS
+ 
+diff -urp evolution-data-server-3.58.3.orig/tests/libedataserver/libedataserver-test.c evolution-data-server-3.58.3/tests/libedataserver/libedataserver-test.c
+--- evolution-data-server-3.58.3.orig/tests/libedataserver/libedataserver-test.c	2026-02-23 13:52:32.825904785 -0600
++++ evolution-data-server-3.58.3/tests/libedataserver/libedataserver-test.c	2026-02-23 14:07:47.810198389 -0600
+@@ -119,6 +119,43 @@ test_parse_date (ETestServerFixture *fix
+ 	}
+ }
+ 
++static void
++test_filename_is_in_path (ETestServerFixture *fixture,
++			  gconstpointer user_data)
++{
++	struct _tests {
++		const gchar *filename;
++		const gchar *path;
++		gboolean expected;
++	} tests[] = {
++		{ "/home/user/.cache/dir/", "/home/user/.cache/dir", FALSE },
++		{ "/home/user/.cache/dir", "/home/user/.cache/dir", FALSE },
++		{ "/home/user/.cache/dir", "/home/user/.cache/dir/", FALSE },
++		{ "/home/user/.cache/dir/", "/home/user/.cache/dir/", FALSE },
++		{ "/home/user/.cache/dir/file.txt", "/home/user/.cache/dir/", TRUE },
++		{ "/home/user/.cache/dir/file.txt", "/home/user/.cache/dir", TRUE },
++		{ "/home/user/.cache/dir/subdir/file.txt", "/home/user/.cache/dir/", TRUE },
++		{ "/home/user/.cache/dir/subdir/file.txt", "/home/user/.cache/dir", TRUE },
++		{ "/home/user/.cache/dir/./file.txt", "/home/user/.cache/dir/", TRUE },
++		{ "/home/user/.cache/dir/./file.txt", "/home/user/.cache/dir", TRUE },
++		{ "/home/user/.cache/dir/../file.txt", "/home/user/.cache/dir/", FALSE },
++		{ "/home/user/.cache/dir/../file.txt", "/home/user/.cache/dir", FALSE },
++		{ "/home/user/.cache/dir/.././dir/../../.cache/./dir/file.txt", "/home/user/.cache/dir/", TRUE },
++		{ "/home/user/.cache/dir/.././dir/../../.cache/./dir/file.txt", "/home/user/.cache/dir", TRUE },
++		{ "/home/user/.cache/dir/../../../../var/lib/file.txt", "/home/user/.cache/dir/", FALSE },
++		{ "/home/user/.cache/dir/../../../../var/lib/file.txt", "/home/user/.cache/dir", FALSE },
++		{ "./file.txt", "/home/user/.cache/dir", FALSE },
++		{ "../file.txt", "/home/user/.cache/dir", FALSE }
++	};
++	gint ii;
++
++	for (ii = 0; ii < G_N_ELEMENTS (tests); ii++) {
++		gboolean result = e_util_filename_is_in_path (tests[ii].filename, tests[ii].path);
++
++		g_assert_cmpint ((result ? 1 : 0), ==, (tests[ii].expected ? 1 : 0));
++	}
++}
++
+ gint
+ main (gint argc,
+       gchar **argv)
+@@ -138,6 +175,12 @@ main (gint argc,
+ 		e_test_server_utils_setup,
+ 		test_parse_date,
+ 		e_test_server_utils_teardown);
++	g_test_add (
++		"/libedataserver-test/FilenameIsInPath",
++		ETestServerFixture, &test_closure,
++		e_test_server_utils_setup,
++		test_filename_is_in_path,
++		e_test_server_utils_teardown);
+ 
+ 	return e_test_server_utils_run (argc, argv);
+ }

evolution-data-server-3.52.4.obscpio

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:1f5b6e0fd779f54439707732e4c9b3446b611bbc31f232ad0a15ae504bea3d5f
-size 42796557

evolution-data-server.changes

@@ -1,3 +1,196 @@
+-------------------------------------------------------------------
+Mon Feb 23 20:41:00 UTC 2026 - Michael Gorse <mgorse@suse.com>
+
+- Add eds-CVE-2026-2604.patch: canonicalize path before local
+  cache file removal (bsc#1258307 CVE-2026-2604
+  glgo#GNOME/evolution-data-server#627).
+
+-------------------------------------------------------------------
+Fri May 23 19:20:20 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.56.2:
+  + Bug Fixes:
+    - Handle changed server pool in WebDAV collection sources ][
+    - CamelDataWrapper: Correct return value of size calculate
+      functions
+    - GOA EWS: Fallback to likely EWS host URL when autodicovery
+      fails
+
+-------------------------------------------------------------------
+Fri Apr 11 06:54:58 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.56.1:
+  + Bug Fix: Handle changed server pool in WebDAV collection
+    sources.
+
+-------------------------------------------------------------------
+Fri Mar 14 12:48:32 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.56.0:
+  + Updated translations.
+
+-------------------------------------------------------------------
+Fri Feb 28 12:31:05 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.55.3:
+  + Bug Fixes:
+    - test-book-client-view-operations: Enforce LC_COLLATE for the
+      backend process
+    - alarm-notify: Tasks without DTSTART cause runtime warning
+  + Miscellaneous:
+    - EBackend: Change when adding signal handler for
+      "network-changed"
+    - CI: Use a Fedora image instead of Flatpak build
+    - camel-mime-utils: Correct a compiler warning [-Wpointer-sign]
+  + Updated translations.
+
+-------------------------------------------------------------------
+Fri Jan 31 18:20:31 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.55.2 (Unstable):
+  + Bug Fixes:
+    - Contacts: Categories miscalculated in the cache
+    - CamelGpgContext: Verify status buffer read is in buffer
+      boundary
+    - devel-doc: Do not require tests to be build
+    - ESoupSession: Leaked input stream on 503 response
+    - build: Use Heimdal KRB5 implementation when found
+    - camel_content_type_decode: Remove unneeded g_free() call
+    - Calendar: Import of forwarded meeting as bare event
+  + Miscellaneous:
+    - Do not use variable named 'bool' in the code
+    - Camel: Disable photo-loading when used gpg version does not
+      understand it
+    - ESoupSession: Check validity of passed-in URI
+  + Updated translations.
+
+-------------------------------------------------------------------
+Sat Jan  4 09:20:08 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.54.3:
+  + Bug Fixed: CalDAV: Do not use SCHEDULE-AGENT parameter.
+
+-------------------------------------------------------------------
+Fri Nov 22 08:39:45 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.54.2:
+  + Bug Fixed:
+    - libedataserverui: Avoid initializing the icon_theme when
+      building introspection data
+    - Fails to build/link against icu 76.1
+    - Correct certificate key usage constants
+  + Updated translations.
+
+-------------------------------------------------------------------
+Mon Nov 18 18:50:25 UTC 2024 - bjorn.lie@gmail.com
+
+- Update to version 3.54.1+4:
+  * libedataserverui: Avoid initializing the icon_theme when
+    building introspection data
+  * Updated translations.
+
+-------------------------------------------------------------------
+Mon Nov 18 09:46:57 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Workaround build failure using ICU 76.1: fix up CMakeLists.txt to
+  link icu-uc instead of icu-i18n
+  (glgo#GNOME/evolution-data-server#574).
+
+-------------------------------------------------------------------
+Fri Oct 18 07:12:04 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.54.1:
+  + Bug Fixes:
+    - Pass GError instead of CamelException to
+      camel_movemail_solaris
+    - Fix argument types in ENABLE_BROKEN_SPOOL code
+    - Use GIConv instead of iconv_t with iconv wrappers
+    - ESoupSession: Sometimes accesses server without OAuth2 token
+  + Updated translations.
+
+-------------------------------------------------------------------
+Fri Sep 13 07:34:22 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Update to version 3.54.0:
+  + Bug Fixes:
+    - Camel: Prefer GLib API for gpg process spawning.
+    - Camel: Correct typos in disabled code.
+  + Miscellaneous: docs: Correct developer documentation to install
+    API indexes.
+  + Updated translations.
+
+-------------------------------------------------------------------
+Fri Aug 30 08:22:20 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.53.3:
+  + Bug Fixes: Camel: Claim attachment in multipart/mixed
+  + Updated translations.
+
+-------------------------------------------------------------------
+Sun Aug 25 12:58:46 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 3.53.2:
+  + module-gnome-online-accounts: Recognize "Microsoft 365"
+    accounts
+  + e_util_get_source_full_name: Fix possible runtime warning
+  + Bug Fixes:
+    - Calendar: Respect TZDIR env variable
+    - alarm-notify: Save acknowledge time without sending iTip
+      message
+    - Calendar: Anniversaries hidden when book goes to online
+    - Camel: 'match-threads' in search folder can miss messages
+    - Add helper object to talk to intune (Microsoft OAuth2 broker
+      service)
+    - e-ms-oapxbc: Check if broker is running before starting it
+    - e-ms-oapxbc: Use GDBusProxy to communicate with broker
+    - Enhance "junk-test" to return also "inconclusive" value
+    - "Thread by Subject" option not propagated to Search Folders
+  + Updated translations.
+- Changes from version 3.53.1:
+  + Calendar: Update comment of
+    E_CAL_STATIC_CAPABILITY_RETRACT_SUPPORTED
+  + CamelMimePart: Fix runtime warning when removing some headers
+  + CamelMimeMessage: Check for non-NULL Subject value before using
+    it
+  + IMAPx: Correct return value of imapx_splice_with_progress()
+    when cancelled
+  + IMAPX: Correct path returned by imapx_get_filename()
+  + OAuth2 Prompter: Fix two memory leaks
+  + EOAuth2ServiceOutlook: Cannot be used with IMAP
+  + EOAuth2ServiceYahoo: Update redirect URI
+  + OAuth2Prompter: Fix possible crash on application quit
+  + Mark org.gnome.evolution-data-server.OAuth2-handler.desktop for
+    translation
+  + Fix few issues reported by Coverity Scan
+  + CI: Pass --verbose to flatpak-builder
+  + CI: Update OpenLDAP version in devel/nightly build
+  + CI: Workaround broken git clone for libcanberra
+  + Bug fixes:
+    - vCard: Incorrectly parses non-UTF-8 vCard data
+    - WebDAV: Handle `Retry-After` header on 503 error
+    - Camel: Sanitize exported OpenPGP public key before transfer
+    - Google Task stale item cannot be deleted
+    - Calendar: "This and Future" modifications can duplicate
+      events
+    - Camel: GPG message decryption can sometimes miss content
+    - CardDAV: Prefetch PHOTO/LOGO when being remote URL
+    - Camel: Attachments not recognized when filtering POP3 message
+    - addressbook-export: Enhance listing of available sources
+    - ECalClient: Generate RECURRENCE-ID in UTC
+    - OAuth2 Prompt: Enlarge "Open in Browser" button
+    - Camel: Search folder's message UID is not persistent
+    - Camel: Unfolding headers eats consecutive white-spaces
+    - Flatpak: Drop org.freedesktop.Sdk.Extension.vala and rely on
+      GNOME SDK
+  + Updated translations.
+- Add pkgconfig(uuid) BuildRequires: New dependency.
+
+-------------------------------------------------------------------
+Mon Aug 19 11:28:03 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- BuildRequire gettext-devel instead of gettext: allow OBS to
+  shortcut through gettext-runtime-mini.
+
 -------------------------------------------------------------------
 Mon Aug  5 06:49:33 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
 
@@ -6365,7 +6558,7 @@ Wed Oct  8 18:40:59 CEST 2008 - sbrabec@suse.cz
 - Fixed broken Advanced search->Include threads (bgo#554455).
 
 -------------------------------------------------------------------
-Fri Oct  3 22:01:46 WST 2008 - mboman@suse.de
+Fri Oct  3 22:01:46 EST 2008 - mboman@suse.de
 
 - Update to version 2.24.0:
   + Google Contacts Backend

evolution-data-server.obsinfo

@@ -1,4 +1,4 @@
 name: evolution-data-server
-version: 3.52.4
-mtime: 1722579615
-commit: b212daab76a47862e071a3bb327123c36540022b
+version: 3.56.2
+mtime: 1748024583
+commit: 9330886fe4c5685bd18d1979bd5c60cb9c3fcc6d

evolution-data-server.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package evolution-data-server
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -32,19 +32,21 @@
 %bcond_without introspection
 
 Name:           evolution-data-server
-Version:        3.52.4
+Version:        3.56.2
 Release:        0
 Summary:        Evolution Data Server
 License:        LGPL-2.0-only
 Group:          Development/Libraries/GNOME
 URL:            https://wiki.gnome.org/Apps/Evolution
 Source0:        %{name}-%{version}.tar.zst
+# PATCH-FIX-UPSTREAM eds-CVE-2026-2604.patch bsc#1258307 mgorse@suse.com -- canonicalize path before local cache file removal.
+Patch0:         eds-CVE-2026-2604.patch
 
 BuildRequires:  cmake >= 3.15
 BuildRequires:  db-devel
 BuildRequires:  fdupes
 BuildRequires:  gcc-c++
-BuildRequires:  gettext
+BuildRequires:  gettext-devel
 BuildRequires:  gobject-introspection-devel
 BuildRequires:  gperf
 BuildRequires:  gtk-doc >= 1.9
@@ -73,6 +75,7 @@ BuildRequires:  pkgconfig(libsecret-unstable) >= 0.5
 BuildRequires:  pkgconfig(libsoup-3.0) >= 2.58
 BuildRequires:  pkgconfig(libxml-2.0)
 BuildRequires:  pkgconfig(protobuf) >= 2.4
+BuildRequires:  pkgconfig(uuid) >= 2.0
 BuildRequires:  pkgconfig(webkit2gtk-4.1)
 BuildRequires:  pkgconfig(webkitgtk-6.0)
 Requires:       mozilla-nss
@@ -329,6 +332,11 @@ This package contains developer documentation.
 
 %prep
 %autosetup -p1
+%if %{pkg_vcmp libicu-devel >= 76.1}
+%dnl Adapt build system to ICU 76.1 - we now need to link icu-uc, no longer icu-i18n
+%dnl https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/574
+sed -i 's/icu-i18n/icu-uc &/' CMakeLists.txt
+%endif
 
 %build
 %if %{with_docs}