Unscored severity · published Sep 29, 2009
CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use…
–
CVSS
1.5%
EPSS
No
On KEV
Description
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensaml · Internet2
2.0; 2.1.0; 2.2.0 · source: NVD
SH
Shibboleth-sp · Internet2
1.3.1; 1.3.2; 1.3b; 1.3f; 2.0; 2.1; +1 more · source: NVD
XM
Xmltooling · Internet2
1.0.1; 1.1.0; 1.1.1; 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3474
Vendor Advisory
http://secunia.com/advisories/36855
Vendor Advisory
http://secunia.com/advisories/36868
Vendor Advisory
http://secunia.com/advisories/36876
Patch
http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt
Patch
http://www.debian.org/security/2009/dsa-1895
Patch
http://www.debian.org/security/2009/dsa-1896
More from Opensaml
–
CVE-2013-6440
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to…
–
CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth…