Expected behavior violation in OpenSSL - CVE-2025-4575

 

Expected behavior violation in OpenSSL - CVE-2025-4575

Published: May 22, 2025


Vulnerability identifier: #VU109657
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-4575
CWE-ID: CWE-440
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability may allow an attacker to gain unauthorized access to the application.

The vulnerability exists due to an error in code related to usage of the "-addreject" option to reject certain x509 certificates. If the option is used, the certificated will be added as trusted instead of rejecting it.


Affected software

OpenSSL
PeopleSoft Enterprise PeopleTools
Siebel CRM Deployment

How to mitigate CVE-2025-4575

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.


External References

Related Security Bulletins