CVE:CVE-2017-5591
CNNVD:CNNVD-201702-342
poezio是一款使用在python3编写的XMPP客户端控制台。SleekXMPP和Slixmp都是其中的分支版本。
poezio 0.8版本至0.10版本中的SleekXMPP 1.3.1之前的版本和Slixmpp 1.2.3之前的版本中存在安全漏洞，该漏洞源于程序没有正确的实现‘XEP-0280: Message Carbons’。远程攻击者可利用该漏洞冒充任意用户。
solution:Upgrade sleekxmpp_project sleekxmpp to a higher version than 1.3.1,and avoid the version (,1.3.1]; Upgrade slixmpp_project slixmpp to a higher version than 1.2.3,and avoid the version (,1.2.3]; Upgrade poezio poezio to a higher version than 0.8,0.8.1,0.9,0.10,and avoid the version 0.8,0.8.1,0.9,0.10