CVE-2021-24119
First published: Wed Jul 14 2021(Updated: )
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ARM mbed TLS | <2.26.0 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ARMmbed/mbedtls/releases
- https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/
Frequently Asked Questions
What is CVE-2021-24119?
CVE-2021-24119 is a side-channel vulnerability in base64 PEM file decoding in Trusted Firmware Mbed TLS 2.24.0.
Who is affected by CVE-2021-24119?
Users of ARM mbed TLS 2.24.0 up to 2.26.0 and Fedora 33, Fedora 34, Debian Linux 9.0, and Debian Linux 10.0 are affected.
How can an attacker exploit CVE-2021-24119?
An attacker with system-level access can use controlled-channel and side-channel attacks to obtain information about secret RSA keys.
What is the severity of CVE-2021-24119?
CVE-2021-24119 has a severity rating of 4.9 (medium).
Where can I find more information about CVE-2021-24119?
You can find more information about CVE-2021-24119 at the following references: [Link1], [Link2], [Link3].
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/arm
- canonical/arm mbed tls
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0