CVE-2021-24119
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding...
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
CVE-2021-24119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE ListNo score
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
CVE-2021-24119- Updated
- 2026-11-02
EUVDEUVD-2021-11034No score
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
EUVD-2021-11034- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7wc7-36pp-g93m
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding...
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
GHSA-7wc7-36pp-g93m- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
CVE-2021-24119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-24119
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
DEBIAN-CVE-2021-24119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVJLSEC-2025-203
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows...
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
JLSEC-2025-203- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-24119
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Record
UBUNTU-CVE-2021-24119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-11
OSVopenSUSE-SU-2021:1344-1No score
Security update for mbedtls
This update for mbedtls fixes the following issues:
CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM [boo#1189589]
Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code.
- Record
openSUSE-SU-2021:1344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1355-1No score
Security update for mbedtls
This update for mbedtls fixes the following issues:
CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM [boo#1189589]
Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code.
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:1355-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1389-1No score
Security update for mbedtls
This update for mbedtls fixes the following issues:
CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM [boo#1189589]
Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code.
- Record
openSUSE-SU-2021:1389-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11552-1No score
libmbedcrypto7-2.27.0-2.1 on GA media
These are all security issues fixed in the libmbedcrypto7-2.27.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11552-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11119-1No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11119-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsDebian:12 | before 2.16.11-0.1 | 2.16.11-0.1 |
mbedtlsDebian:13 | before 2.16.11-0.1 | 2.16.11-0.1 |
mbedtlsDebian:14 | before 2.16.11-0.1 | 2.16.11-0.1 |
mbedtlsDebian:9 From an advisory covering 6 CVEs | before 2.4.2-1+deb9u4, plus listed versions 2.4.2-12.4.2-1+deb9u12.4.2-1+deb9u1~bpo8+12.4.2-1+deb9u22.4.2-1+deb9u3 | 2.4.2-1+deb9u4 |
mbedtlsDebian:10 From an advisory covering 18 CVEs | before 2.16.9-0~deb10u1, plus listed versions 2.16.0-12.16.2-12.16.3-12.16.4-12.16.5-1 | 2.16.9-0~deb10u1 |
mbedtlsDebian:11 From an advisory covering 5 CVEs | before 2.16.9-0.1+deb11u1, plus listed versions 2.16.9-0.1 | 2.16.9-0.1+deb11u1 |
MbedTLS_jllJulia | before 2.26.0+0 | 2.26.0+0 |
mbedtlsUbuntu:16.04:LTS | All versions, plus listed versions 2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3 | None known |
mbedtlsUbuntu:Pro:18.04:LTS | All versions, plus listed versions 2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1 | None known |
mbedtlsUbuntu:Pro:20.04:LTS | All versions, plus listed versions 2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1 | None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mbedtlsUbuntu:Pro:22.04:LTS | All versions, plus listed versions 2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1 | None known |
mbedtlsUbuntu:25.10 | All versions, plus listed versions 3.6.2-3ubuntu1 | None known |
mbedtlsUbuntu:26.10 | All versions, plus listed versions 3.6.5-0.1ubuntu23.6.6-0.1ubuntu13.6.7-3ubuntu1 | None known |
mbedtlsUbuntu:26.04:LTS | All versions, plus listed versions 3.6.2-3ubuntu13.6.5-0.1ubuntu13.6.5-0.1ubuntu2 | None known |
mbedtlsopenSUSE:Leap 15.2 | before 2.16.9-lp152.2.6.1 | 2.16.9-lp152.2.6.1 |
mbedtlsSUSE:Package Hub 15 SP2 | before 2.16.9-bp152.2.6.1 | 2.16.9-bp152.2.6.1 |
mbedtlsSUSE:Package Hub 15 SP3 | before 2.16.9-bp153.2.5.1 | 2.16.9-bp153.2.5.1 |
mbedtlsopenSUSE:Leap 15.3 | before 2.16.9-bp153.2.5.1 | 2.16.9-bp153.2.5.1 |
mbedtls-2openSUSE:Tumbleweed | before 2.27.0-2.1 | 2.27.0-2.1 |
mbedtls-3openSUSE:Tumbleweed From an advisory covering 14 CVEs | before 3.6.6-1.1 | 3.6.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24119 is a medium vulnerability (CVSS 4.9) in Arm Mbed Tls, published July 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in mbedtls 2.16.11-0.1.
References
github.com/ARMmbed/mbedtls/releases
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6
lists.debian.org/debian-lts-announce/2021/11/msg00021.html
Show 26 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-24119
security-tracker.debian.org/tracker/CVE-2021-24119
ubuntu.com/security/CVE-2021-24119
cve.org/CVERecord?id=CVE-2021-24119
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TUAORD5DVNESTJH3EH3OO36VCU4DKEPQ
bugzilla.suse.com/1189589
suse.com/security/cve/CVE-2021-24119