OpenSSL Vulnerability CVE-2025-4575: Misconfiguration of Trusted Certificate Uses
Summary
CVE-2025-4575: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Affects openssl across 2 version ranges.
< 3.5.1-r0
< e96d22446e633d117e6c9904cb15b4693e956eaa
Fixed in 3.5.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used open-source software library that provides robust cryptographic functions and protocols, including SSL and TLS for secure communications over networks. It is integral to the security of many applications and systems, enabling secure data transmission and authentication. The library is frequently updated to address security vulnerabilities and improve functionality. However, certain versions of OpenSSL, specifically version 3.5, have introduced a vulnerability that affects how trusted certificates are configured, potentially leading to misconfigured trust settings.
Vulnerability Detail
The vulnerability identified as CVE-2025-4575 arises from a coding error in OpenSSL version 3.5, where the -addreject option used with the openssl x509 command mistakenly adds a trusted use instead of a rejected use for a certificate. This misconfiguration can lead to a situation where a certificate intended to be rejected for specific uses, such as CMS signature verification, is instead marked as trusted. This could result in unauthorized trust being granted to certificates, potentially compromising security. The issue is particularly relevant for users who rely on the command line application to manage trusted certificates.
How To Fix
Minimum fixed version
3.5.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users should avoid using the -addreject option with the openssl x509 command until a patch is released.
Conclusion
CVE-2025-4575 is a significant vulnerability in OpenSSL 3.5 that can lead to misconfigured trust settings for certificates. Users are advised to update their OpenSSL installations as soon as a patch is available and to exercise caution when using the openssl x509 command line application.
See every vulnerability recorded for openssl →
FAQ
CVE-2025-4575 is a vulnerability in OpenSSL 3.5 that incorrectly marks a certificate as trusted instead of rejected when using the -addreject option.
Only users who utilize the trusted certificate format and the openssl x509 command line application to manage certificate uses are affected.
The primary risk is that a certificate intended to be rejected for specific uses may be trusted, leading to potential security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As of now, there is no patched version available for OpenSSL 3.5. Users should keep an eye on updates from the OpenSSL project.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
