CVE-2016-20021

Gentoo Portage missing PGP validation of executed code

9.8 CriticalFix available

CVE-2016-20021 is a critical vulnerability (CVSS 9.8) in Gentoo Portage, published January 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in portage 3.0.47.

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.47%Up 0.4 points since Jan 17, 2024

What each source reports

NVD Score used 9.8

Record: CVE-2016-20021
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2016-20021
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

EUVDEUVD-2024-0149 9.8

Record: EUVD-2024-0149
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pw5x-x5jw-ccmh 8.1

Gentoo Portage missing PGP validation of executed code

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

Record: GHSA-pw5x-x5jw-ccmh
CVSS 4.0: 8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-20021
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-pw5x-x5jw-ccmh 8.1

Gentoo Portage missing PGP validation of executed code

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

Record: GHSA-pw5x-x5jw-ccmh
CVSS 4.0: 8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

OSVPYSEC-2024-10 9.8

Record: PYSEC-2024-10
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

gentoo portage

Affected packages

Affected packages
Package	Affected	Fixed
`portage` PyPI	before 3.0.47	3.0.47
`portage` PyPI	before 3.0.47, plus listed versions 3.0.183.0.193.0.203.0.213.0.22 Show 28 moreShow less 3.0.233.0.243.0.253.0.263.0.273.0.283.0.293.0.303.0.313.0.323.0.333.0.343.0.353.0.363.0.373.0.383.0.38.13.0.393.0.403.0.413.0.423.0.433.0.443.0.453.0.45.13.0.45.23.0.45.33.0.46	3.0.47

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV