GitHub Advisory DatabaseGHSA-PW5X-X5JW-CCMHGentoo Portage missing PGP validation of executed code
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.
Affected configurations
References
bugs.gentoo.org/597800
github.com/advisories/GHSA-pw5x-x5jw-ccmh
github.com/gentoo/portage/commit/28cd240fb23d880b8641a058831c6762db71c3e2
github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2024-10.yaml
gitweb.gentoo.org/proj/portage.git/tree/NEWS
gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b3c80502e96406b4b175e2ee79eb65f3f3cd9f6
nvd.nist.gov/vuln/detail/CVE-2016-20021
wiki.gentoo.org/wiki/Portage
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High