CVE-2021-24119

MEDIUM 4.9CVE-2021-24119 · Published 14/07/2021 · updated 17/06/2026

In short

CVE-2021-24119 is a MEDIUM (CVSS 4.9) vulnerability affecting mbed tls (arm).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.0% of all vulnerabilities.
Fix: update to 2.26.0 or later.

Package	Affected versions	Patched versions
mbed tls arm	`< 2.26.0`	`2.26.0`

Description

In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.

References

ARMmbed/mbedtls release · Release Notes
UzL-ITS/util-lookup · Release Notes
lists.debian.org/debian-lts-announce/2021/11/msg00021.html · Mailing List
lists.debian.org/debian-lts-announce/2022/12/msg00036.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6 · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW · Mailing List
lists.debian.org/debian-lts-announce/2025/06/msg00034.html

More vulnerabilities in mbed tls

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mbed tls

arm

< 2.26.0

2.26.0

Description

More vulnerabilities in mbed tls

See all →