OpenSSL Vulnerability: Misconfiguration of Trusted Certificate Uses
Summary
ALPINE-CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Affects openssl versions < 3.5.1-r0. Fixed in 3.5.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used open-source toolkit for implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It provides a robust framework for secure communication over computer networks. The affected version, OpenSSL 3.5, introduced a flaw in the handling of certificate uses, specifically when utilizing the -addreject option in the x509 command line application. This vulnerability can lead to unintended trust configurations for certificates, potentially compromising security.
Vulnerability Detail
The vulnerability arises from a copy & paste error during minor code refactoring in OpenSSL 3.5. When users attempt to mark a trusted certificate as rejected for a specific use with the -addreject option, the certificate is incorrectly marked as trusted instead. This misconfiguration can lead to security risks, as a certificate intended to be restricted for certain uses may inadvertently be trusted, allowing for unauthorized operations. The issue affects only users employing the command line application for managing trusted certificates and is classified as low severity.
How To Fix
Minimum fixed version
3.5.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to avoid using the -addreject option until they can update to the patched version.
Conclusion
In summary, the OpenSSL vulnerability identified as ALPINE-CVE-2025-4575 poses a risk of misconfiguration in trusted certificate uses due to a coding error. Users are encouraged to update to version 3.5.1-r0 or later to mitigate this issue and ensure the integrity of their certificate management processes.
See every vulnerability recorded for openssl →
FAQ
The vulnerability can lead to trusted certificates being incorrectly marked, allowing for unauthorized uses, which could compromise security.
Only users who utilize the OpenSSL x509 command line application to manage trusted certificates are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
OpenSSL version 3.5 is affected by this vulnerability. Versions 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1, and 1.0.2 are not affected.
If immediate updating is not possible, refrain from using the -addreject option until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
