« Volver al listado

CVE-2009-3474

Estado: ModificadaAlta (7.5)—

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Internet2 — OpensamlInternet2 — Shibboleth-spInternet2 — Xmltooling

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3474",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-29T23:30:00.217",
  "references": [
    {
      "url": "http://secunia.com/advisories/36855",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36868",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36876",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1895",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1896",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36516",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.internet2.edu/jira/browse/CPPOST-28",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53474",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36855",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36868",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36876",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1895",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1896",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36516",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.internet2.edu/jira/browse/CPPOST-28",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate."
    },
    {
      "lang": "es",
      "value": "OpenSAML v2.x anterior a v2.2.1 y XMLTooling v1.x anterior a v1.2.1, utilizado por Internet2 Shibboleth Service Provider v2.x anterior a v2.2.1,no siguen el atributo Use del elemento KeyDescriptor, lo cual permite a atacantes remotos utilizar un certificado para la firma y encriptación, cuando esta designado para un solo fin, debilitando potencialmente el propósito de aplicación de seguridad del certificado."
    }
  ],
  "lastModified": "2026-06-16T23:11:40.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "258372E2-533F-46CB-B25A-5ECB3CC2F22F"
            },
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1122AD73-8FDD-4387-A237-B493CE0D547E"
            },
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0192C838-FD63-4CF7-9BF0-9BAFF101C612"
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2D36F93-B9DE-422C-AD73-3D8AA58DB6BE"
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5FCBF08-0DD9-4899-B4F5-5D7BFB0B5830"
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5457FF44-CB80-486B-B3B2-D40F34565976"
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C3A371A-AF3E-44E5-8854-C5D61FF5660C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE02AD93-8ED6-46F1-81D8-B70CB9EB79BF"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6CF3BEC-262B-4901-8D73-D8BB1869A166"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6EE490F-9E85-44F9-9608-86D4FBDAD331"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4515685C-B170-4829-9261-8FAD5C9F1874"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FC9CB94-188C-4BE2-AD8E-EBBA5BA3731E"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9E3DA80-673A-47D7-BDE2-0AC112BB6C4C"
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "673CCD0B-9202-4EBA-96B2-11A438E8D464"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}