OpenSSL 3.5.0 < 3.5.1 Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237112);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-4575");
  script_xref(name:"IAVA", value:"2025-A-0378-S");

  script_name(english:"OpenSSL 3.5.0 < 3.5.1 Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote service is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of OpenSSL installed on the remote host is prior to 3.5.1. It is, therefore, affected by a vulnerability as
referenced in the 3.5.1 advisory.

  - Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a
    rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected
    for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor
    refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA
    certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature
    verification and the CMS signature verification is intended to be marked as rejected with the -addreject
    option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only
    users which use the trusted certificate format who use the openssl x509 command line application to add
    rejected uses are affected by this issue. The issues affecting only the command line application are
    considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by
    this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
    (CVE-2025-4575)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71c5cf95");
  script_set_attribute(attribute:"see_also", value:"https://openssl-library.org/news/secadv/20250522.txt");
  # https://openssl-library.org/policies/general/security-policy/index.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eac4598c");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2025-4575");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSL version 3.5.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4575");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/22");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openssl:openssl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openssl_version.nasl", "openssl_nix_installed.nbin", "openssl_win_installed.nbin");
  script_require_keys("installed_sw/OpenSSL");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_openssl.inc');

var app_info = vcf::combined_get_app_info(app:'OpenSSL');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '3.5.0', 'fixed_version' : '3.5.1' }
];

vcf::openssl::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);