CVE-2025-4575
published 2025-05-22CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.31%
22.6th percentile
Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate.
Impact summary: If a user intends to make a trusted certificate rejected for
a particular use it will be instead marked as trusted for that use.
A copy & paste error during minor refactoring of the code introduced this
issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate
should be trusted only for the purpose of authenticating TLS servers but not
for CMS signature verification and the CMS signature verification is intended
to be marked as rejected with the -addreject option, the resulting CA
certificate will be trusted for CMS signature verification purpose instead.
Only users which use the trusted certificate format who use the openssl x509
command line application to add rejected uses are affected by this issue.
The issues affecting only the command line application are considered to
be Low severity.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue.
OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this
issue.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.5.0-2 (forky) | openssl 3.5.0-2 (forky) |
| msrc | azl3_rust_1.75.0-22_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-24_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-3_on_azure_linux_3.0 | — | — |
| openssl | openssl | — | — |
| openssl | openssl | >= 0 < 3.5.1-r0 | 3.5.1-r0 |
| openssl | openssl | >= 0 < 3.5.1-r0 | 3.5.1-r0 |
| openssl | openssl | >= 0 < 3.5.0-2 | 3.5.0-2 |
| openssl | openssl | >= 0 < 3.5.0-2 | 3.5.0-2 |
| openssl | openssl | >= 3.5.0 < 3.5.1 | 3.5.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_msrc6.5MEDIUM
vendor_oracle6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v8qh-5c5w-48pp: Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate
ghsa_unreviewed·2025-05-22
CVE-2025-4575 [MEDIUM] CWE-295 GHSA-v8qh-5c5w-48pp: Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate
Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate.
Impact summary: If a user intends to make a trusted certificate rejected for
a particular use it will be instead marked as trusted for that use.
A copy & paste error during minor refactoring of the code introduced this
issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate
should be trusted only for the purpose of authenticating TLS servers but not
for CMS signature verification and the CMS signature verification is intended
to be marked as rejected with the -addreject option, the resulting CA
certificate will be trusted for CMS signature verification purpose instead.
Only users which use the trusted certificate format who use the
OSV
CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate
osv·2025-05-22·CVSS 6.5
CVE-2025-4575 [MEDIUM] CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate
Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the op
OSV
CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate
osv·2025-05-22·CVSS 6.5
CVE-2025-4575 [MEDIUM] CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate
Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate.
Impact summary: If a user intends to make a trusted certificate rejected for
a particular use it will be instead marked as trusted for that use.
A copy & paste error during minor refactoring of the code introduced this
issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate
should be trusted only for the purpose of authenticating TLS servers but not
for CMS signature verification and the CMS signature verification is intended
to be marked as rejected with the -addreject option, the resulting CA
certificate will be trusted for CMS signature verification purpose instead.
Only users which use the trusted certificate format who use the
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Server Infrastructure (OpenSSL) — CVE-2025-4575
vendor_oracle·2026-01-15·CVSS 6.5
CVE-2025-4575 [MEDIUM] Oracle Oracle Siebel CRM Risk Matrix: Server Infrastructure (OpenSSL) — CVE-2025-4575
Oracle Oracle Siebel CRM Risk Matrix: Server Infrastructure (OpenSSL) vulnerability
CVE: CVE-2025-4575
CVSS: 6.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Security, Porting, Cloud Deployment Architecture (OpenSSL) — CVE-2025-4575
vendor_oracle·2025-10-15·CVSS 6.5
CVE-2025-4575 [MEDIUM] Oracle Oracle PeopleSoft Risk Matrix: Security, Porting, Cloud Deployment Architecture (OpenSSL) — CVE-2025-4575
Oracle Oracle PeopleSoft Risk Matrix: Security, Porting, Cloud Deployment Architecture (OpenSSL) vulnerability
CVE: CVE-2025-4575
CVSS: 6.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Microsoft
The x509 application adds trusted use instead of rejected use
vendor_msrc·2025-05-13·CVSS 6.5
CVE-2025-4575 [MEDIUM] CWE-295 The x509 application adds trusted use instead of rejected use
The x509 application adds trusted use instead of rejected use
Mariner: Mariner
openssl: openssl
Customer Action Required: Yes
Debian
CVE-2025-4575: openssl - Issue summary: Use of -addreject option with the openssl x509 application adds a...
vendor_debian·2025·CVSS 6.5
CVE-2025-4575 [MEDIUM] CVE-2025-4575: openssl - Issue summary: Use of -addreject option with the openssl x509 application adds a...
Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the op
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-22
Published