CVE-2025-4575

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-4575", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2025-05-12T12:08:11.215Z", "datePublished": "2025-05-22T13:36:49.694Z", "dateUpdated": "2025-05-22T16:03:42.330Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "3.5.1", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Alexandr Sosedkin (Red Hat)"}, {"lang": "en", "type": "remediation developer", "value": "Tom\u00e1\u0161 Mr\u00e1z"}], "datePublic": "2025-05-22T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: Use of -addreject option with the openssl x509 application adds<br>a trusted use instead of a rejected use for a certificate.<br><br>Impact summary: If a user intends to make a trusted certificate rejected for<br>a particular use it will be instead marked as trusted for that use.<br><br>A copy & paste error during minor refactoring of the code introduced this<br>issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate<br>should be trusted only for the purpose of authenticating TLS servers but not<br>for CMS signature verification and the CMS signature verification is intended<br>to be marked as rejected with the -addreject option, the resulting CA<br>certificate will be trusted for CMS signature verification purpose instead.<br><br>Only users which use the trusted certificate format who use the openssl x509<br>command line application to add rejected uses are affected by this issue.<br>The issues affecting only the command line application are considered to<br>be Low severity.<br><br>The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this<br>issue.<br><br>OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this<br>issue."}], "value": "Issue summary: Use of -addreject option with the openssl x509 application adds\na trusted use instead of a rejected use for a certificate.\n\nImpact summary: If a user intends to make a trusted certificate rejected for\na particular use it will be instead marked as trusted for that use.\n\nA copy & paste error during minor refactoring of the code introduced this\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\nshould be trusted only for the purpose of authenticating TLS servers but not\nfor CMS signature verification and the CMS signature verification is intended\nto be marked as rejected with the -addreject option, the resulting CA\ncertificate will be trusted for CMS signature verification purpose instead.\n\nOnly users which use the trusted certificate format who use the openssl x509\ncommand line application to add rejected uses are affected by this issue.\nThe issues affecting only the command line application are considered to\nbe Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue.\n\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\nissue."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2025-05-22T13:36:49.694Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20250522.txt"}, {"name": "3.5.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa"}], "source": {"discovery": "UNKNOWN"}, "title": "The x509 application adds trusted use instead of rejected use", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-22T14:30:40.495897Z", "id": "CVE-2025-4575", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T14:32:40.965Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/05/22/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-05-22T16:03:42.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/05/22/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-05-22T16:03:42.330Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-4575", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-22T14:30:40.495897Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T14:32:36.477Z"}}], "cna": {"title": "The x509 application adds trusted use instead of rejected use", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alexandr Sosedkin (Red Hat)"}, {"lang": "en", "type": "remediation developer", "value": "Tom\u00e1\u0161 Mr\u00e1z"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Low"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "3.5.0", "lessThan": "3.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-05-22T14:00:00.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20250522.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa", "name": "3.5.1 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: Use of -addreject option with the openssl x509 application adds\na trusted use instead of a rejected use for a certificate.\n\nImpact summary: If a user intends to make a trusted certificate rejected for\na particular use it will be instead marked as trusted for that use.\n\nA copy & paste error during minor refactoring of the code introduced this\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\nshould be trusted only for the purpose of authenticating TLS servers but not\nfor CMS signature verification and the CMS signature verification is intended\nto be marked as rejected with the -addreject option, the resulting CA\ncertificate will be trusted for CMS signature verification purpose instead.\n\nOnly users which use the trusted certificate format who use the openssl x509\ncommand line application to add rejected uses are affected by this issue.\nThe issues affecting only the command line application are considered to\nbe Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue.\n\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\nissue.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: Use of -addreject option with the openssl x509 application adds<br>a trusted use instead of a rejected use for a certificate.<br><br>Impact summary: If a user intends to make a trusted certificate rejected for<br>a particular use it will be instead marked as trusted for that use.<br><br>A copy & paste error during minor refactoring of the code introduced this<br>issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate<br>should be trusted only for the purpose of authenticating TLS servers but not<br>for CMS signature verification and the CMS signature verification is intended<br>to be marked as rejected with the -addreject option, the resulting CA<br>certificate will be trusted for CMS signature verification purpose instead.<br><br>Only users which use the trusted certificate format who use the openssl x509<br>command line application to add rejected uses are affected by this issue.<br>The issues affecting only the command line application are considered to<br>be Low severity.<br><br>The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this<br>issue.<br><br>OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this<br>issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2025-05-22T13:36:49.694Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4575", "state": "PUBLISHED", "dateUpdated": "2025-05-22T16:03:42.330Z", "dateReserved": "2025-05-12T12:08:11.215Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2025-05-22T13:36:49.694Z", "assignerShortName": "openssl"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "3.5.1", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "91ADE80D-F0FB-4EC0-AAB1-2AA34E2FC63D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: Use of -addreject option with the openssl x509 application adds\na trusted use instead of a rejected use for a certificate.\n\nImpact summary: If a user intends to make a trusted certificate rejected for\na particular use it will be instead marked as trusted for that use.\n\nA copy & paste error during minor refactoring of the code introduced this\nissue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate\nshould be trusted only for the purpose of authenticating TLS servers but not\nfor CMS signature verification and the CMS signature verification is intended\nto be marked as rejected with the -addreject option, the resulting CA\ncertificate will be trusted for CMS signature verification purpose instead.\n\nOnly users which use the trusted certificate format who use the openssl x509\ncommand line application to add rejected uses are affected by this issue.\nThe issues affecting only the command line application are considered to\nbe Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue.\n\nOpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this\nissue."}, {"lang": "es", "value": "Resumen del problema: El uso de la opci\u00f3n -addreject con la aplicaci\u00f3n openssl x509 a\u00f1ade un uso confiable en lugar de uno rechazado para un certificado. Resumen del impacto: Si un usuario intenta rechazar un certificado confiable para un uso espec\u00edfico, se marcar\u00e1 como confiable para ese uso. Un error de copiar y pegar durante una peque\u00f1a refactorizaci\u00f3n del c\u00f3digo introdujo este problema en la versi\u00f3n OpenSSL 3.5. Si, por ejemplo, un certificado de CA confiable solo debe ser confiable para autenticar servidores TLS, pero no para la verificaci\u00f3n de firmas CMS, y esta verificaci\u00f3n se marca como rechazada con la opci\u00f3n -addreject, el certificado de CA resultante se considerar\u00e1 confiable para la verificaci\u00f3n de firmas CMS. Este problema solo afecta a los usuarios que usan el formato de certificado confiable y la aplicaci\u00f3n de l\u00ednea de comandos openssl x509 para a\u00f1adir usos rechazados. Los problemas que afectan solo a la aplicaci\u00f3n de l\u00ednea de comandos se consideran de gravedad baja. Los m\u00f3dulos FIPS de las versiones 3.5, 3.4, 3.3, 3.2, 3.1 y 3.0 no se ven afectados. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 y 1.0.2 tampoco se ven afectados por este problema."}], "id": "CVE-2025-4575", "lastModified": "2026-06-17T09:33:33.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4575", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-22T14:30:40.495897Z", "version": "2.0.3"}}]}, "published": "2025-05-22T14:16:07.630", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20250522.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/05/22/1"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{}

{"created": "2025-06-24T09:44:16.645253+00:00", "updated": "2025-06-24T09:44:16.645299+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}