← Back

CVE-2009-3474

nvd nist
Published: Sep 29, 2009Modified: Apr 23, 2026

JSON object

Loading...
7.5
Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 10.0 / Impact: 6.4
Source: NVD

Description

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

Affected (14)

Internet2
3 products
Opensaml
Xmltooling
Shibboleth Sp
Configuration A
14 vulnerable
Vulnerable SoftwareAffected Versions
Internet2
Opensaml
Version 2.0
Opensaml
Version 2.1.0
Opensaml
Version 2.2.0
Internet2
Xmltooling
Version 1.0.1
Xmltooling
Version 1.1.0
Xmltooling
Version 1.1.1
Xmltooling
Version 1.2.0
Internet2
Shibboleth Sp
Version 1.3.1
Shibboleth Sp
Version 1.3.2
Shibboleth Sp
Version 1.3b
Shibboleth Sp
Version 1.3f
Shibboleth Sp
Version 2.0
Shibboleth Sp
Version 2.1
Shibboleth Sp
Version 2.2

Related CWEs

CWE-310
CWE-310

References (18)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
PatchVendor Advisory
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.