Expected behavior violation in OpenSSL - CVE-2025-4575

Vulnerability identifier: #VU109657

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-4575

CWE-ID: CWE-440

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability may allow an attacker to gain unauthorized access to the application.

The vulnerability exists due to an error in code related to usage of the "-addreject" option to reject certain x509 certificates. If the option is used, the certificated will be added as trusted instead of rejecting it.

OpenSSL
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Web and Scripting Module
PeopleSoft Enterprise PeopleTools
Siebel CRM Deployment
libopenssl-fips-provider
libopenssl-devel
openssl
libopenssl-3-fips-provider
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit
libopenssl-3-fips-provider-32bit
libopenssl3-32bit-debuginfo
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl3
openssl-3-debuginfo
libopenssl-3-fips-provider-debuginfo
libopenssl-3-devel
openssl-3
nodejs24-devel
nodejs24-docs
nodejs24-debuginfo
npm24
nodejs24
nodejs24-debugsource

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libopenssl-fips-provider - update to 3.5.0-150700.3.4.1
libopenssl-devel - update to 3.5.0-150700.3.4.1
openssl - update to 3.5.0-150700.3.4.1
libopenssl-3-fips-provider - update to 3.5.0-150700.5.45.2
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.5.0-150700.5.45.2
libopenssl3-32bit - update to 3.5.0-150700.5.45.2
libopenssl-3-fips-provider-32bit - update to 3.5.0-150700.5.45.2
libopenssl3-32bit-debuginfo - update to 3.5.0-150700.5.45.2
libopenssl3-debuginfo - update to 3.5.0-150700.5.45.2
openssl-3-debugsource - update to 3.5.0-150700.5.45.2
libopenssl3 - update to 3.5.0-150700.5.45.2
openssl-3-debuginfo - update to 3.5.0-150700.5.45.2
libopenssl-3-fips-provider-debuginfo - update to 3.5.0-150700.5.45.2
libopenssl-3-devel - update to 3.5.0-150700.5.45.2
openssl-3 - update to 3.5.0-150700.5.45.2
nodejs24-devel - update to 24.18.1-150700.15.18.1
nodejs24-docs - update to 24.18.1-150700.15.18.1
nodejs24-debuginfo - update to 24.18.1-150700.15.18.1
npm24 - update to 24.18.1-150700.15.18.1
nodejs24 - update to 24.18.1-150700.15.18.1
nodejs24-debugsource - update to 24.18.1-150700.15.18.1

• https://openssl-library.org/news/secadv/20250522.txt

• Expected behavior violation in OpenSSL
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Siebel CRM Deployment
• SUSE update for openssl, openssl-3