Every CVESearch/Get API key

CVE-2009-3475

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when...

7.5 HighFix available

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

0.89%Down 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used7.5

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-3475
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-3475
Updated
2026-11-02
EUVDEUVD-2009-3457No score

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
EUVD-2009-3457
Updated
2026-11-03
GitHub AdvisoriesGHSA-g23p-47j7-w4hwNo score

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when...

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
GHSA-g23p-47j7-w4hw
Updated
2026-11-02
OSVNo score

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-3475
Updated
2026-11-02
OSVDEBIAN-CVE-2009-3475No score

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
DEBIAN-CVE-2009-3475
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensaml
Debian:12
before 3.0.0-2
3.0.0-2
opensaml
Debian:13
before 3.0.0-2
3.0.0-2
opensaml
Debian:14
before 3.0.0-2
3.0.0-2
shibboleth-sp
Debian:12
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
shibboleth-sp
Debian:13
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
shibboleth-sp
Debian:14
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
xmltooling
Debian:12
before 1.2.2-1
1.2.2-1
xmltooling
Debian:13
before 1.2.2-1
1.2.2-1
xmltooling
Debian:14
before 1.2.2-1
1.2.2-1
xmltooling
Debian:5.0
From an advisory covering 3 CVEs
before 1.0-2+lenny1, plus listed versions
1.0-2
1.0-2+lenny1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
opensaml2
Debian:5.0
From an advisory covering 3 CVEs
before 2.0-2+lenny1, plus listed versions
2.0-2
2.0-2+lenny1
shibboleth-sp2
Debian:5.0
From an advisory covering 3 CVEs
before 2.0.dfsg1-4+lenny1, plus listed versions
2.0.dfsg1-4
2.0.dfsg1-4+lenny1
opensaml
Debian:4.0
From an advisory covering 3 CVEs
before 1.1a-2+etch1, plus listed versions
1.1a-2
1.1a-2+etch1
shibboleth-sp
Debian:4.0
From an advisory covering 3 CVEs
before 1.3f.dfsg1-2+etch1, plus listed versions
1.3f.dfsg1-2
1.3f.dfsg1-2+etch1
opensaml
Debian:5.0
From an advisory covering 3 CVEs
before 1.1.1-2+lenny1, plus listed versions
1.1.1-21.1.1-2+lenny1~bpo40+1
1.1.1-2+lenny1
shibboleth-sp
Debian:5.0
From an advisory covering 3 CVEs
before 1.3.1.dfsg1-3+lenny1, plus listed versions
1.3.1.dfsg1-31.3.1.dfsg1-3+lenny1~bpo40+1
1.3.1.dfsg1-3+lenny1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3475 is a high vulnerability (CVSS 7.5) in Internet2 Shibboleth-sp, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in opensaml 3.0.0-2.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open