GCVE - cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*

part: a version: 1.3.1 update: *

Vendor	Internet2 (`b0df8a0f-1ff0-5922-98b8-e93458a53ff0`)
Product	Shibboleth Sp (`d49b1854-bdc1-5ada-a420-7fb49604d908`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/internet2/shibboleth-multi-context-broker`	purl2cpe	2026-06-01 10:10:59.277840

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-3476`	vulnerable	2026-06-08 04:51:42.261064	Details available Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL. Published: 2009-09-29T23:00:00.000Z Updated: 2024-08-07T06:31:09.966Z Open on db.gcve.eu Reference links http://secunia.com/advisories/36870 http://www.securityfocus.com/bid/36514 http://secunia.com/advisories/36869 https://exchange.xforce.ibmcloud.com/vulnerabilities/53471 http://shibboleth.internet2.edu/secadv/secadv_20090826.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3475`	vulnerable	2026-06-08 04:51:42.260543	Details available Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Published: 2009-09-29T23:00:00.000Z Updated: 2024-09-17T02:16:57.067Z Open on db.gcve.eu Reference links http://secunia.com/advisories/36876 http://www.debian.org/security/2009/dsa-1896 http://www.debian.org/security/2009/dsa-1895 http://shibboleth.internet2.edu/secadv/secadv_20090817.txt http://secunia.com/advisories/36861	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3474`	vulnerable	2026-06-08 04:51:42.256425	Details available OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate. Published: 2009-09-29T23:00:00.000Z Updated: 2024-08-07T06:31:10.133Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/36516 https://exchange.xforce.ibmcloud.com/vulnerabilities/53474 http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt http://secunia.com/advisories/36876 http://www.debian.org/security/2009/dsa-1896	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.