CVE-2025-4575

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-4575
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4575.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4575
Downstream
Published
2025-05-22T14:16:07Z
Modified
2025-07-03T16:06:52.054047Z
Summary
[none]
Details

Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate.

Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use.

A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead.

Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.

References

Affected packages

Alpine:v3.22 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.1-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r1
3.0.7-r2
3.0.8-r0
3.0.8-r1
3.1.0-r0
3.1.0-r1
3.1.0-r2
3.1.0-r3
3.1.0-r4
3.1.0-r5
3.1.1-r0
3.1.1-r1
3.1.1-r2
3.1.1-r3
3.1.2-r0
3.1.3-r0
3.1.4-r0
3.1.4-r1
3.1.4-r2
3.1.4-r3
3.1.4-r4
3.1.4-r5
3.1.5-r5
3.2.1-r0
3.2.1-r1
3.2.1-r2
3.3.0-r0
3.3.0-r1
3.3.0-r2
3.3.0-r3
3.3.1-r0
3.3.1-r1
3.3.1-r2
3.3.1-r3
3.3.2-r0
3.3.2-r1
3.3.2-r2
3.3.2-r3
3.3.2-r4
3.3.2-r5
3.3.2-r6
3.3.3-r0
3.5.0-r0

Debian:13 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.0-2

Affected versions

3.*

3.0.9-1
3.0.10-1~deb12u1
3.0.10-1
3.0.11-1~deb12u1
3.0.11-1~deb12u2
3.0.11-1
3.0.12-1
3.0.12-2
3.0.13-1~deb12u1
3.0.13-1~deb12u2
3.0.14-1~deb12u1
3.0.14-1~deb12u2
3.0.15-1~deb12u1
3.0.16-1~deb12u1
3.1.0-1
3.1.1-1
3.1.2-1
3.1.3-1
3.1.4-1
3.1.4-2
3.1.5-1
3.1.5-1.1
3.1.5-1.1+hurd.1
3.2.0-1
3.2.0-2
3.2.1-1
3.2.1-1.1~exp1
3.2.1-2
3.2.1-3
3.2.2-1
3.3.0~beta1-1
3.3.0-1
3.3.1-1
3.3.1-2
3.3.1-5
3.3.1-6
3.3.1-7
3.3.2-1
3.3.2-2
3.4.0~~beta1-1
3.4.0~~beta1-2
3.4.0-1
3.4.0-2
3.4.1-1
3.5.0~~alpha1-1
3.5.0~~beta1-1
3.5.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e96d22446e633d117e6c9904cb15b4693e956eaa

Affected versions

Other

BEFORE_engine
OpenSSL_0_9_1c
OpenSSL_0_9_2b
OpenSSL_0_9_3
OpenSSL_0_9_3a
OpenSSL_0_9_3beta2
OpenSSL_0_9_4
OpenSSL_0_9_5a
OpenSSL_0_9_5a-beta1
OpenSSL_0_9_5a-beta2
OpenSSL_0_9_5beta1
OpenSSL_0_9_5beta2
OpenSSL_0_9_6-beta3
OpenSSL_1_1_0-pre1
OpenSSL_1_1_0-pre2
OpenSSL_1_1_0-pre3
OpenSSL_1_1_0-pre4
OpenSSL_1_1_0-pre5
OpenSSL_1_1_0-pre6
OpenSSL_1_1_1
OpenSSL_1_1_1-pre1
OpenSSL_1_1_1-pre2
OpenSSL_1_1_1-pre3
OpenSSL_1_1_1-pre4
OpenSSL_1_1_1-pre5
OpenSSL_1_1_1-pre6
OpenSSL_1_1_1-pre7
OpenSSL_1_1_1-pre8
OpenSSL_1_1_1-pre9
master-post-auto-reformat
master-post-reformat
master-pre-auto-reformat
master-pre-reformat

openssl-3.*

openssl-3.0.0-alpha1
openssl-3.0.0-alpha10
openssl-3.0.0-alpha11
openssl-3.0.0-alpha12
openssl-3.0.0-alpha13
openssl-3.0.0-alpha14
openssl-3.0.0-alpha15
openssl-3.0.0-alpha16
openssl-3.0.0-alpha17
openssl-3.0.0-alpha2
openssl-3.0.0-alpha3
openssl-3.0.0-alpha4
openssl-3.0.0-alpha5
openssl-3.0.0-alpha6
openssl-3.0.0-alpha7
openssl-3.0.0-alpha8
openssl-3.0.0-alpha9
openssl-3.0.0-beta1
openssl-3.0.0-beta2
openssl-3.2.0-alpha1
openssl-3.2.0-alpha2
openssl-3.4.0-alpha1
openssl-3.5.0
openssl-3.5.0-alpha1
openssl-3.5.0-beta1