CVE-2016-20021

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-12 · updated 2026-06-17
Weakness: CWE-347

Description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Affected products

gentoo Portage: before 3.0.47 — fixed in 3.0.47

How to fix

Upgrade to a fixed version: gentoo Portage 3.0.47. Check the vendor advisory for mitigations.

References

https://bugs.gentoo.org/597800
https://gitweb.gentoo.org/proj/portage.git/tree/NEWS
https://wiki.gentoo.org/wiki/Portage
https://bugs.gentoo.org/597800
https://gitweb.gentoo.org/proj/portage.git/tree/NEWS
https://wiki.gentoo.org/wiki/Portage

Get alerted when CVE-2016-20021 or the next vulnerability affects your stack