Certificate Misconfiguration Vulnerability in OpenSSL by OpenSSL
CVE-2025-4575

6.5MEDIUM

Key Information:

Vendor

OpenSSL
Status
OpenSSL
Vendor
CVE Published:
22 May 2025

What is CVE-2025-4575?

A flaw in the OpenSSL version 3.5 introduces a misconfiguration issue regarding the use of the -addreject option in the x509 command line application. When a user attempts to set a trusted certificate as rejected for certain uses, instead, it is erroneously designated as trusted. This could lead to a trusted CA certificate being recognized for purposes it should not be used for, such as CMS signature verification. Only users utilizing the trusted certificate format with the openssl x509 command are impacted, while earlier OpenSSL versions and FIPS modules remain unaffected.

Affected Version(s)

OpenSSL 3.5.0 < 3.5.1

References

https://openssl-library.org/news/secadv/20250522.txt
vendor-advisory
https://github.com/openssl/openssl/commit/e96d22446e633d1...
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexandr Sosedkin (Red Hat)
Tomáš Mráz
.
CVE-2025-4575 : Certificate Misconfiguration Vulnerability in OpenSSL by OpenSSL