CVE-2009-3474: High severity internet2 opensaml vulnerability
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3474?
CVE-2009-3474 is classified as a high-severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2009-3474?
To fix CVE-2009-3474, upgrade to OpenSAML version 2.2.1 or XMLTooling version 1.2.1 or later.
What systems are affected by CVE-2009-3474?
CVE-2009-3474 affects OpenSAML versions 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, particularly when used with Shibboleth Service Provider 2.x before 2.2.1.
What are the risks associated with CVE-2009-3474?
The risks of CVE-2009-3474 include allowing attackers to use a certificate intended for single purpose (signing or encryption) for both roles.
Is there a workaround for CVE-2009-3474?
Currently, there are no specified workarounds for CVE-2009-3474, and it is recommended to apply an upgrade as soon as possible.