VULNERABILITY

FreeBSD: VID-5BAA64D6-37EE-11F0-A116-8447094A420F (CVE-2025-4575): OpenSSL -- Inverted security logic in x509 app

Try Surface Command Get a continuous 360° view of your attack surface
Back to Search

FreeBSD: VID-5BAA64D6-37EE-11F0-A116-8447094A420F (CVE-2025-4575): OpenSSL -- Inverted security logic in x509 app

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
05/22/2025
Created
05/27/2025
Added
05/24/2025
Modified
05/30/2025

Description

Issue summary: Use of -addreject option with the openssl x509 application adds

a trusted use instead of a rejected use for a certificate.

Impact summary: If a user intends to make a trusted certificate rejected for

a particular use it will be instead marked as trusted for that use.

A copy & paste error during minor refactoring of the code introduced this

issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate

should be trusted only for the purpose of authenticating TLS servers but not

for CMS signature verification and the CMS signature verification is intended

to be marked as rejected with the -addreject option, the resulting CA

certificate will be trusted for CMS signature verification purpose instead.

Only users which use the trusted certificate format who use the openssl x509

command line application to add rejected uses are affected by this issue.

The issues affecting only the command line application are considered to

be Low severity.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this

issue.

OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this

issue.

Solution(s)

  • freebsd-upgrade-package-openssl35

References

  • CVE-2025-4575

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;