CVE-2009-3475 — Shibboleth-sp vulnerability

5 documents5 sources
Severity
7.5HIGHNVD
CNA5.9OSV5.9
EPSS
0.4%
top 41.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Internet2 Shibboleth-spXmltooling Project Xmltooling
Timeline
PublishedSep 29
Latest updateMay 2

Description

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶Debianinternet2/shibboleth-sp< 3.0.2+dfsg1-2+3
▶NVDinternet2/shibboleth-sp6 versions+5
▶Debianxmltooling_project/xmltooling< 1.2.2-1+3

🔴Vulnerability Details

3
GHSA
GHSA-g23p-47j7-w4hw: Internet2 Shibboleth Service Provider software 1↗2022-05-02
▶
OSV
CVE-2009-3475: Internet2 Shibboleth Service Provider software 1↗2009-09-29
▶
CVEList
CVE-2009-3475: Internet2 Shibboleth Service Provider software 1↗2009-09-29
▶

📋Vendor Advisories

1
Debian
CVE-2009-3475: opensaml - Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before...↗2009
▶
CVE-2009-3475 — Internet2 Shibboleth-sp vulnerability | cvebase