CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth...
CVE-2009-3474 is a high vulnerability (CVSS 7.5) in Internet2 Opensaml, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in opensaml 3.0.0-2.
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Exploit likelihood
What each source reports
NVD Score used
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
CVE-2009-3474- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
CVE-2009-3474- Updated
- 2026-11-02
EUVDEUVD-2009-3456 No score
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
EUVD-2009-3456- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-575w-rwc7-4259 No score
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth...
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
GHSA-575w-rwc7-4259- Updated
- 2026-11-02
OSV No score
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
CVE-2009-3474- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3474 No score
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Record
DEBIAN-CVE-2009-3474- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensamlDebian:12 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:13 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:14 |
before 3.0.0-2 | 3.0.0-2 |
shibboleth-spDebian:12 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
xmltoolingDebian:12 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:13 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:14 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:5.0 |
before 1.0-2+lenny1, plus listed versions 1.0-2 |
1.0-2+lenny1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensaml2Debian:5.0 |
before 2.0-2+lenny1, plus listed versions 2.0-2 |
2.0-2+lenny1 |
shibboleth-sp2Debian:5.0 |
before 2.0.dfsg1-4+lenny1, plus listed versions 2.0.dfsg1-4 |
2.0.dfsg1-4+lenny1 |
opensamlDebian:4.0 |
before 1.1a-2+etch1, plus listed versions 1.1a-2 |
1.1a-2+etch1 |
shibboleth-spDebian:4.0 |
before 1.3f.dfsg1-2+etch1, plus listed versions 1.3f.dfsg1-2 |
1.3f.dfsg1-2+etch1 |
opensamlDebian:5.0 |
before 1.1.1-2+lenny1, plus listed versions 1.1.1-21.1.1-2+lenny1~bpo40+1 |
1.1.1-2+lenny1 |
shibboleth-spDebian:5.0 |
before 1.3.1.dfsg1-3+lenny1, plus listed versions 1.3.1.dfsg1-31.3.1.dfsg1-3+lenny1~bpo40+1 |
1.3.1.dfsg1-3+lenny1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |