Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (JDOM)). Supported versions that are affected are 17.0-25.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Deployment. (CVE-2018-1000632, CVE-2020-10683, CVE-2021-33813)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure     (OpenSSL)). Supported versions that are affected are 17.0-25.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel     CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS)     of Siebel CRM Deployment. (CVE-2025-4575)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a
    rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected
    for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor
    refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA
    certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature
    verification and the CMS signature verification is intended to be marked as rejected with the -addreject
    option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only
    users which use the trusted certificate format who use the openssl x509 command line application to add
    rejected uses are affected by this issue. The issues affecting only the command line application are
    considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by
    this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
    (CVE-2025-4575)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5baa64d6-37ee-11f0-a116-8447094a420f advisory.

    The OpenSSL project reports:
    The x509 application adds trusted use instead of rejected use (low)

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.5.1. It is, therefore, affected by a vulnerability as referenced in the 3.5.1 advisory.

  - Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a     rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected     for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor     refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA     certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature     verification and the CMS signature verification is intended to be marked as rejected with the -addreject     option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only     users which use the trusted certificate format who use the openssl x509 command line application to add     rejected uses are affected by this issue. The issues affecting only the command line application are     considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by     this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
    (CVE-2025-4575)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
294867	Oracle Siebel Server <= 25.11 (January 2026 CPU)	Nessus	Misc.	critical
428282	Alpine: libcrypto3, multiple openssl packages: security update to 3.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
428282	Alpine: libcrypto3, multiple openssl packages: security update to 3.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
237210	FreeBSD : OpenSSL -- Inverted security logic in x509 app (5baa64d6-37ee-11f0-a116-8447094a420f)	Nessus	FreeBSD Local Security Checks	medium
237112	OpenSSL 3.5.0 < 3.5.1 Vulnerability	Nessus	Web Servers	medium

Detections

Analytics

CVE-2025-4575

medium

Tenable Plugins

critical

medium

medium

medium

medium