CVE-2009-3474

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-29 · updated 2026-06-16
Weakness: CWE-310

Description

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

Affected products

Internet2 Opensaml: 2.0, 2.1.0, 2.2.0
Internet2 Shibboleth-Sp: 1.3.1, 1.3.2, 1.3b, 1.3f, 2.0, 2.1 (+1)
Internet2 Xmltooling: 1.0.1, 1.1.0, 1.1.1, 1.2.0

References

http://secunia.com/advisories/36855
http://secunia.com/advisories/36868
http://secunia.com/advisories/36876
http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt
http://www.debian.org/security/2009/dsa-1895
http://www.debian.org/security/2009/dsa-1896
http://www.securityfocus.com/bid/36516
https://bugs.internet2.edu/jira/browse/CPPOST-28
https://exchange.xforce.ibmcloud.com/vulnerabilities/53474
http://secunia.com/advisories/36855
http://secunia.com/advisories/36868
http://secunia.com/advisories/36876

Get alerted when CVE-2009-3474 or the next vulnerability affects your stack