CVE-2009-3474 json
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow…
published 2009-09-29 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3456
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Patch / fix
- opensaml Debian 14, Debian 13, Debian 12 3.0.0-2
- xmltooling Debian 14, Debian 13, Debian 12 1.2.2-1
- shibboleth-sp Debian 14, Debian 13, Debian 12 3.0.2+dfsg1-2
debian advisories DEBIAN-CVE-2009-3474
Exploit prediction
1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-310 Cryptographic Issues
References
-
debian.org
/security/2009/dsa-1896
vendor-advisory, patch
-
debian.org
/security/2009/dsa-1895
vendor-advisory, patch
-
securityfocus.com
/bid/36516
vdb-entry, patch
-
shibboleth.internet2.edu
/secadv/secadv_20090817a.txt
patch, vendor-advisory
-
secunia.com
/advisories/36876
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/36868
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/36855
third-party-advisory, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/53474
vdb-entry
- bugs.internet2.edu /jira/browse/CPPOST-28
Sources
- CVE List CVE-2009-3474
- NVD CVE-2009-3474
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.