CVE-2009-3475
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when...
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploit likelihood
What each source reports
NVD Score used
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3475- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3475- Updated
- 2026-11-02
EUVDEUVD-2009-3457 No score
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
EUVD-2009-3457- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g23p-47j7-w4hw No score
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when...
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
GHSA-g23p-47j7-w4hw- Updated
- 2026-11-02
OSV No score
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3475- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3475 No score
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
DEBIAN-CVE-2009-3475- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensamlDebian:12 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:13 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:14 |
before 3.0.0-2 | 3.0.0-2 |
shibboleth-spDebian:12 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
xmltoolingDebian:12 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:13 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:14 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:5.0 |
before 1.0-2+lenny1, plus listed versions 1.0-2 |
1.0-2+lenny1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensaml2Debian:5.0 |
before 2.0-2+lenny1, plus listed versions 2.0-2 |
2.0-2+lenny1 |
shibboleth-sp2Debian:5.0 |
before 2.0.dfsg1-4+lenny1, plus listed versions 2.0.dfsg1-4 |
2.0.dfsg1-4+lenny1 |
opensamlDebian:4.0 |
before 1.1a-2+etch1, plus listed versions 1.1a-2 |
1.1a-2+etch1 |
shibboleth-spDebian:4.0 |
before 1.3f.dfsg1-2+etch1, plus listed versions 1.3f.dfsg1-2 |
1.3f.dfsg1-2+etch1 |
opensamlDebian:5.0 |
before 1.1.1-2+lenny1, plus listed versions 1.1.1-21.1.1-2+lenny1~bpo40+1 |
1.1.1-2+lenny1 |
shibboleth-spDebian:5.0 |
before 1.3.1.dfsg1-3+lenny1, plus listed versions 1.3.1.dfsg1-31.3.1.dfsg1-3+lenny1~bpo40+1 |
1.3.1.dfsg1-3+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3475 is a high vulnerability (CVSS 7.5) in Internet2 Shibboleth-sp, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in opensaml 3.0.0-2.
References
secunia.com/advisories/36876
debian.org/security/2009/dsa-1896
shibboleth.internet2.edu/secadv/secadv_20090817.txt
nvd.nist.gov/vuln/detail/CVE-2009-3475
github.com/advisories/GHSA-g23p-47j7-w4hw
security-tracker.debian.org/tracker/CVE-2009-3475