UnratedFix available
opensaml, shibboleth-sp and 1 more products — security advisory
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
- Products
- opensaml, shibboleth-sp, xmltooling
- Affected versions
- Not specified
- Fixed versions
- 1.2.2-1, 3.0.0-2, 3.0.2+dfsg1-2
- CVEs
- CVE-2009-3474
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:41 UTC · Revision 1
Source evidence
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
osv:DEBIAN-CVE-2009-3474
opensaml
Fixed versions: 3.0.0-2
opensaml
Fixed versions: 3.0.0-2
opensaml
Fixed versions: 3.0.0-2
shibboleth-sp
Fixed versions: 3.0.2+dfsg1-2
shibboleth-sp
Fixed versions: 3.0.2+dfsg1-2
shibboleth-sp
Fixed versions: 3.0.2+dfsg1-2
xmltooling
Fixed versions: 1.2.2-1
xmltooling
Fixed versions: 1.2.2-1
xmltooling
Fixed versions: 1.2.2-1
Complete source record
{
"id": "ed3e7850017a93b582397aaa397820b0b139fc4f2274a761d9f0bcc25e8fa68b",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2009-3474",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2009-3474",
"summary": "OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.",
"evidence": "osv:DEBIAN-CVE-2009-3474",
"products": [
{
"name": {
"value": "opensaml",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.0-2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "opensaml",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.0-2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "opensaml",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.0-2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "shibboleth-sp",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.2+dfsg1-2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "shibboleth-sp",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.2+dfsg1-2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "shibboleth-sp",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.2+dfsg1-2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xmltooling",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2-1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xmltooling",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2-1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xmltooling",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2-1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2009-3474",
"aliases": [
"DEBIAN-CVE-2009-3474"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-2"
}
]
}
],
"package": {
"name": "opensaml",
"purl": "pkg:deb/debian/opensaml?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-2"
}
]
}
],
"package": {
"name": "opensaml",
"purl": "pkg:deb/debian/opensaml?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-2"
}
]
}
],
"package": {
"name": "opensaml",
"purl": "pkg:deb/debian/opensaml?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.2+dfsg1-2"
}
]
}
],
"package": {
"name": "shibboleth-sp",
"purl": "pkg:deb/debian/shibboleth-sp?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.2+dfsg1-2"
}
]
}
],
"package": {
"name": "shibboleth-sp",
"purl": "pkg:deb/debian/shibboleth-sp?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.2+dfsg1-2"
}
]
}
],
"package": {
"name": "shibboleth-sp",
"purl": "pkg:deb/debian/shibboleth-sp?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2-1"
}
]
}
],
"package": {
"name": "xmltooling",
"purl": "pkg:deb/debian/xmltooling?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2-1"
}
]
}
],
"package": {
"name": "xmltooling",
"purl": "pkg:deb/debian/xmltooling?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2-1"
}
]
}
],
"package": {
"name": "xmltooling",
"purl": "pkg:deb/debian/xmltooling?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3474.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:28.075366081Z",
"provider": "osv",
"upstream": [
"CVE-2009-3474"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2009-3474"
]
},
"related_cves": [
{
"value": "CVE-2009-3474",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417071,
"published_at": "2009-09-29T23:30:00.217+00:00"
}