CVE-2009-3475 — Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408

Back Back to CVE browser

HIGH

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408

Published Sep 29, 2009

7.5

HIGH

CVSS 2.0

EPSS 0.89%

Description

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.89% 0.00891

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00891

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.89% (0.00891)	57.99th	v5 (v2026.06.15)
Jun 15, 2026	0.89% (0.00891)	54.55th	v5 (v2026.06.15)
Mar 17, 2025	0.36% (0.00360)	56.04th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00089)	39.70th	v3 (v2023.03.01)
Apr 25, 2024	0.12% (0.00118)	45.14th	v3 (v2023.03.01)
Mar 15, 2024	0.11% (0.00112)	43.42th	v3 (v2023.03.01)
Feb 8, 2024	0.10% (0.00095)	38.55th	v3 (v2023.03.01)
Mar 7, 2023	0.09% (0.00089)	36.28th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Sep 17, 2022	1.11% (0.01108)	53.57th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)

Weaknesses (1)

CWE-310

References (6)

http://secunia.com/advisories/36855
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/36861
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/36876
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
x_refsource_CONFIRMVendor Advisory
http://www.debian.org/security/2009/dsa-1895
vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2009/dsa-1896
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
http://secunia.com/advisories/36855		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/36861		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/36876		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090817.txt		x_refsource_CONFIRMVendor Advisory
http://www.debian.org/security/2009/dsa-1895		vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2009/dsa-1896		vendor-advisoryx_refsource_DEBIAN

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 29, 2009

Updated Sep 17, 2024

Reserved Sep 29, 2009

Link CVE-2009-3475

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-3475

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-3475