CVE-2009-3476

CRITICAL 9.3CVE-2009-3476 · Published 29/09/2009 · updated 16/06/2026

In short

CVE-2009-3476 is a CRITICAL (CVSS 9.3) vulnerability affecting opensaml (internet2), shibboleth-sp (internet2), xmltooling (internet2).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
opensaml internet2	`= 1.1= 1.1.1`	No fix yet
shibboleth-sp internet2	`= 1.3.1= 1.3.2= 1.3.3= 1.3f= 2.0= 2.1= 2.2`	No fix yet
xmltooling internet2	`= 1.0.1= 1.1.0= 1.1.1= 1.2.0= 1.2.1`	No fix yet

Description

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.

References

secunia.com/advisories/36869 · Vendor Advisory
secunia.com/advisories/36870 · Vendor Advisory
shibboleth.internet2.edu/secadv/secadv_20090826.txt · Vendor Advisory
securityfocus.com/bid/36514
exchange.xforce.ibmcloud.com/vulnerabilities/53471

More vulnerabilities in opensaml

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free