PT-2025-22478 · Openssl · Openssl

Alexandr Sosedkin + 1 · Published 2025-05-02 · Updated 2026-04-27 · CVE-2025-4575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenSSL version 3.5

Description The issue arises from the use of the -addreject option with the openssl x509 application, which adds a trusted use instead of a rejected use for a certificate. This means if a user intends to make a trusted certificate rejected for a particular use, it will be instead marked as trusted for that use. The problem was introduced by a copy & paste error during minor refactoring of the code in the OpenSSL 3.5 version. Only users who use the trusted certificate format and the openssl x509 command line application to add rejected uses are affected.

Recommendations For OpenSSL version 3.5, consider avoiding the use of the -addreject option with the openssl x509 application until a fix is available. As a temporary workaround, manually verify the certificate uses after adding them to ensure they match the intended configuration.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-06413

CVE-2025-4575

JLSEC-2026-259

OPENSUSE-SU-2025:15183-1

Affected Products

Openssl

References · 27

• https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa · Patch
• https://openssl-library.org/news/secadv/20250522.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06413 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4575 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-4575 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-4575 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-4575 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-259 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15183-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-4575 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4575 · Vendor Advisory
• https://openwall.com/lists/oss-security/2025/05/22/1 · Note
• https://vuldb.com/ru/?id.309981 · Note
• https://suse.com/security/cve/CVE-2025-4575 · Note
• https://security.alpinelinux.org/vuln/CVE-2025-4575 · Note