CVE-2016-20021 Gentoo Portage missing PGP validation of executed code

What is CVE-2016-20021?

CVE-2016-20021 is a critical vulnerability in n/a, published on 12 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Weakness: CWE-347

Which versions are affected by CVE-2016-20021?

3 open source packages ship an affected version, including portage. It affects 1 product.

Products include Gentoo Portage.

How do I fix CVE-2016-20021?

Upgrade portage to 3.0.47 or later.

Is CVE-2016-20021 being exploited?

There is no known exploitation of CVE-2016-20021 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-2100 Gentoo Portage does not verify X.509 certificates from SSL servers Critical 9.3
• CVE-2004-2778 Privilege escalation in n/a High 7.1
• CVE-2008-4394 Path traversal in n/a Medium 6.9
• CVE-2019-20384 Race condition in n/a Medium 5.5
• CVE-2007-6249 Information disclosure in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pw5x-x5jw-ccmh, PYSEC-2024-10.