CVE-2025-4575 (GCVE-0-2025-4575)

Vulnerability from cvelistv5 – Published: 2025-05-22 13:36 – Updated: 2025-05-22 16:03
VLAI
Title
The x509 application adds trusted use instead of rejected use
Summary
Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
OpenSSL OpenSSL Affected: 3.5.0 , < 3.5.1 (semver)
Create a notification for this product.
Date Public
2025-05-22 14:00
Credits
Alexandr Sosedkin (Red Hat) Tomáš Mráz
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-4575",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:30:40.495897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:32:40.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-22T16:03:42.330Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/22/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.5.1",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexandr Sosedkin (Red Hat)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom\u00e1\u0161 Mr\u00e1z"
        }
      ],
      "datePublic": "2025-05-22T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Use of -addreject option with the openssl x509 application adds\u003cbr\u003ea trusted use instead of a rejected use for a certificate.\u003cbr\u003e\u003cbr\u003eImpact summary: If a user intends to make a trusted certificate rejected for\u003cbr\u003ea particular use it will be instead marked as trusted for that use.\u003cbr\u003e\u003cbr\u003eA copy \u0026 paste error during minor refactoring of the code introduced this\u003cbr\u003eissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\u003cbr\u003eshould be trusted only for the purpose of authenticating TLS servers but not\u003cbr\u003efor CMS signature verification and the CMS signature verification is intended\u003cbr\u003eto be marked as rejected with the -addreject option, the resulting CA\u003cbr\u003ecertificate will be trusted for CMS signature verification purpose instead.\u003cbr\u003e\u003cbr\u003eOnly users which use the trusted certificate format who use the openssl x509\u003cbr\u003ecommand line application to add rejected uses are affected by this issue.\u003cbr\u003eThe issues affecting only the command line application are considered to\u003cbr\u003ebe Low severity.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\u003cbr\u003eissue.\u003cbr\u003e\u003cbr\u003eOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\u003cbr\u003eissue."
            }
          ],
          "value": "Issue summary: Use of -addreject option with the openssl x509 application adds\na trusted use instead of a rejected use for a certificate.\n\nImpact summary: If a user intends to make a trusted certificate rejected for\na particular use it will be instead marked as trusted for that use.\n\nA copy \u0026 paste error during minor refactoring of the code introduced this\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\nshould be trusted only for the purpose of authenticating TLS servers but not\nfor CMS signature verification and the CMS signature verification is intended\nto be marked as rejected with the -addreject option, the resulting CA\ncertificate will be trusted for CMS signature verification purpose instead.\n\nOnly users which use the trusted certificate format who use the openssl x509\ncommand line application to add rejected uses are affected by this issue.\nThe issues affecting only the command line application are considered to\nbe Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue.\n\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\nissue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T13:36:49.694Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20250522.txt"
        },
        {
          "name": "3.5.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "The x509 application adds trusted use instead of rejected use",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2025-4575",
    "datePublished": "2025-05-22T13:36:49.694Z",
    "dateReserved": "2025-05-12T12:08:11.215Z",
    "dateUpdated": "2025-05-22T16:03:42.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-4575",
      "date": "2026-06-05",
      "epss": "0.00077",
      "percentile": "0.23059"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-4575\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2025-05-22T14:16:07.630\",\"lastModified\":\"2025-10-23T14:51:30.377\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: Use of -addreject option with the openssl x509 application adds\\na trusted use instead of a rejected use for a certificate.\\n\\nImpact summary: If a user intends to make a trusted certificate rejected for\\na particular use it will be instead marked as trusted for that use.\\n\\nA copy \u0026 paste error during minor refactoring of the code introduced this\\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\\nshould be trusted only for the purpose of authenticating TLS servers but not\\nfor CMS signature verification and the CMS signature verification is intended\\nto be marked as rejected with the -addreject option, the resulting CA\\ncertificate will be trusted for CMS signature verification purpose instead.\\n\\nOnly users which use the trusted certificate format who use the openssl x509\\ncommand line application to add rejected uses are affected by this issue.\\nThe issues affecting only the command line application are considered to\\nbe Low severity.\\n\\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\\nissue.\\n\\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\\nissue.\"},{\"lang\":\"es\",\"value\":\"Resumen del problema: El uso de la opci\u00f3n -addreject con la aplicaci\u00f3n openssl x509 a\u00f1ade un uso confiable en lugar de uno rechazado para un certificado. Resumen del impacto: Si un usuario intenta rechazar un certificado confiable para un uso espec\u00edfico, se marcar\u00e1 como confiable para ese uso. Un error de copiar y pegar durante una peque\u00f1a refactorizaci\u00f3n del c\u00f3digo introdujo este problema en la versi\u00f3n OpenSSL 3.5. Si, por ejemplo, un certificado de CA confiable solo debe ser confiable para autenticar servidores TLS, pero no para la verificaci\u00f3n de firmas CMS, y esta verificaci\u00f3n se marca como rechazada con la opci\u00f3n -addreject, el certificado de CA resultante se considerar\u00e1 confiable para la verificaci\u00f3n de firmas CMS. Este problema solo afecta a los usuarios que usan el formato de certificado confiable y la aplicaci\u00f3n de l\u00ednea de comandos openssl x509 para a\u00f1adir usos rechazados. Los problemas que afectan solo a la aplicaci\u00f3n de l\u00ednea de comandos se consideran de gravedad baja. Los m\u00f3dulos FIPS de las versiones 3.5, 3.4, 3.3, 3.2, 3.1 y 3.0 no se ven afectados. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 y 1.0.2 tampoco se ven afectados por este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91ADE80D-F0FB-4EC0-AAB1-2AA34E2FC63D\"}]}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://openssl-library.org/news/secadv/20250522.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/05/22/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/05/22/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-05-22T16:03:42.330Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-4575\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-22T14:30:40.495897Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-22T14:32:36.477Z\"}}], \"cna\": {\"title\": \"The x509 application adds trusted use instead of rejected use\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Alexandr Sosedkin (Red Hat)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Tom\\u00e1\\u0161 Mr\\u00e1z\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Low\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-05-22T14:00:00.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20250522.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa\", \"name\": \"3.5.1 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue summary: Use of -addreject option with the openssl x509 application adds\\na trusted use instead of a rejected use for a certificate.\\n\\nImpact summary: If a user intends to make a trusted certificate rejected for\\na particular use it will be instead marked as trusted for that use.\\n\\nA copy \u0026 paste error during minor refactoring of the code introduced this\\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\\nshould be trusted only for the purpose of authenticating TLS servers but not\\nfor CMS signature verification and the CMS signature verification is intended\\nto be marked as rejected with the -addreject option, the resulting CA\\ncertificate will be trusted for CMS signature verification purpose instead.\\n\\nOnly users which use the trusted certificate format who use the openssl x509\\ncommand line application to add rejected uses are affected by this issue.\\nThe issues affecting only the command line application are considered to\\nbe Low severity.\\n\\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\\nissue.\\n\\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\\nissue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue summary: Use of -addreject option with the openssl x509 application adds\u003cbr\u003ea trusted use instead of a rejected use for a certificate.\u003cbr\u003e\u003cbr\u003eImpact summary: If a user intends to make a trusted certificate rejected for\u003cbr\u003ea particular use it will be instead marked as trusted for that use.\u003cbr\u003e\u003cbr\u003eA copy \u0026 paste error during minor refactoring of the code introduced this\u003cbr\u003eissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\u003cbr\u003eshould be trusted only for the purpose of authenticating TLS servers but not\u003cbr\u003efor CMS signature verification and the CMS signature verification is intended\u003cbr\u003eto be marked as rejected with the -addreject option, the resulting CA\u003cbr\u003ecertificate will be trusted for CMS signature verification purpose instead.\u003cbr\u003e\u003cbr\u003eOnly users which use the trusted certificate format who use the openssl x509\u003cbr\u003ecommand line application to add rejected uses are affected by this issue.\u003cbr\u003eThe issues affecting only the command line application are considered to\u003cbr\u003ebe Low severity.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\u003cbr\u003eissue.\u003cbr\u003e\u003cbr\u003eOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\u003cbr\u003eissue.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2025-05-22T13:36:49.694Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-4575\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-22T16:03:42.330Z\", \"dateReserved\": \"2025-05-12T12:08:11.215Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2025-05-22T13:36:49.694Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.