Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-20021

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Published

2024-01-12T03:15:08.410

Last Modified

2025-06-03T14:15:26.830

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Primary
    CWE-347
  • Type: Secondary
    CWE-347
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gentoo portage < 3.0.47 Yes
References