CVE-2016-20021

2024-01-1200:00:00

mitre

www.cve.org

gentoo

portage

pgp

validation

emerge-webrsync

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

References

bugs.gentoo.org/597800

gitweb.gentoo.org/proj/portage.git/tree/NEWS

wiki.gentoo.org/wiki/Portage