CVE-2021-24119: Arm Mbed TLS

Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days.

In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.

Affected products

• Arm Mbed TLS: before 2.26.0 (fixed in 2.26.0)
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only

Published 2021-07-14. Last modified 2026-06-17.