Every CVESearch/Get API key

CVE-2016-20021

Gentoo Portage missing PGP validation of executed code

9.8 CriticalFix available

CVE-2016-20021 is a critical vulnerability (CVSS 9.8) in Gentoo Portage, published January 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in portage 3.0.47.

What does this mean?
Severity
9.8 CriticalCVSS 3.1, NVD
Exploit chance
0.46%EPSS, 40th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.0.47portage +1 more

Description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.46%Up 0.4 points since Jan 17, 2024
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
portage
PyPI
before 3.0.47
3.0.47
portage
PyPI
before 3.0.47, plus listed versions
3.0.183.0.193.0.203.0.213.0.22
Show 28 moreShow less
3.0.233.0.243.0.253.0.263.0.273.0.283.0.293.0.303.0.313.0.323.0.333.0.343.0.353.0.363.0.373.0.383.0.38.13.0.393.0.403.0.413.0.423.0.433.0.443.0.453.0.45.13.0.45.23.0.45.33.0.46
3.0.47

What each source reports

NVD Score used9.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Record
CVE-2016-20021
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
CVE List9.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Record
CVE-2016-20021
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2024-01499.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Record
EUVD-2024-0149
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pw5x-x5jw-ccmh8.1

Gentoo Portage missing PGP validation of executed code

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

Record
GHSA-pw5x-x5jw-ccmh
CVSS 4.0
8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
OSV9.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Record
CVE-2016-20021
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-pw5x-x5jw-ccmh8.1

Gentoo Portage missing PGP validation of executed code

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

Record
GHSA-pw5x-x5jw-ccmh
CVSS 4.0
8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
OSVPYSEC-2024-109.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Record
PYSEC-2024-10
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

History

History
RecordedChangedSources
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open