CVE-2016-20021
Critical
Description
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
SeverityCritical
CVSS9.8
Exploit probability41. percentile0.5%
Product
Gentoo Portage
PublishedJan 12, 2024
First seenJan 12, 2024
Weakness typeCWE-347CWE-347
How to fix
Update
- gentoo portage3.0.47 or later
- portage3.0.47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gentoo portage | v < 3.0.47 | 3.0.47 |
| portagePyPI | v < 3.0.47 | 3.0.47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.