CVE-2016-20021: In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform…

PriorityP352critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.46%

36.9th percentile

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
gentoo	portage	< 3.0.47	3.0.47
gentoo	portage	>= 0 < 3.0.47	3.0.47

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.