NetSight
IP …
high7.5

CVE-2009-3474

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor e…

Impact

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

Affected products

VendorProductAffected versions
Internet2Opensaml
Versions 2.0, 2.1.0, 2.2.0
Internet2Xmltooling
Versions 1.0.1, 1.1.0, 1.1.1, 1.2.0
Internet2Shibboleth-Sp
Versions 1.3.1, 1.3.2, 1.3b, 1.3f, 2.0, 2.1

Weakness classification

CWE-310

References