Description
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | opensaml | 3.0.0-2 | — |
| Debian 14 | shibboleth-sp | 3.0.2+dfsg1-2 | — |
| Debian 14 | xmltooling | 1.2.2-1 | — |
| Debian 13 | opensaml | 3.0.0-2 | — |
| Debian 13 | shibboleth-sp | 3.0.2+dfsg1-2 | — |
| Debian 13 | xmltooling | 1.2.2-1 | — |
| Debian 12 | opensaml | 3.0.0-2 | — |
| Debian 12 | shibboleth-sp | 3.0.2+dfsg1-2 | — |
| Debian 12 | xmltooling | 1.2.2-1 | — |
| Debian 5.0 | opensaml | 1.1.1-2+lenny1 | DSA-1896-1 |
| Debian 5.0 | opensaml2 | 2.0-2+lenny1 | DSA-1895-2 |
| Debian 5.0 | shibboleth-sp | 1.3.1.dfsg1-3+lenny1 | DSA-1896-1 |
| Debian 5.0 | shibboleth-sp2 | 2.0.dfsg1-4+lenny1 | DSA-1895-2 |
| Debian 5.0 | xmltooling | 1.0-2+lenny1 | DSA-1895-1 |
| Debian 4.0 | opensaml | 1.1a-2+etch1 | DSA-1896-1 |
| Debian 4.0 | shibboleth-sp | 1.3f.dfsg1-2+etch1 | DSA-1896-1 |
Advisories 3
- DSA-1895-1 xmltooling - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1896-1 opensaml shibboleth-sp - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1895-2 opensaml2, shibboleth-sp2 - interpretation conflict Debian Security (DSA / DLA) · Mar 9, 2026
References
- 36516 vdb-entry
- opensaml-keydescriptor-security-bypass(53474) vdb-entry
- http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt
- 36876 third-party-advisory
- DSA-1896 vendor-advisory
- 36868 third-party-advisory
- DSA-1895 vendor-advisory
- https://bugs.internet2.edu/jira/browse/CPPOST-28
- 36855 third-party-advisory