Gentoo Portage missing PGP validation of executed code

严重 9.8CVE-2016-20021 · GHSA-pw5x-x5jw-ccmh · PYSEC-2024-10 · Published 12/01/2024 · updated 17/06/2026

要点

CVE-2016-20021 是影响 portage, portage (gentoo) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.47%，高于 40.5% 的漏洞。
修复：升级到 3.0.47 或更高版本。

Package	Affected versions	Patched versions
portage PyPI	`< 3.0.47`	`3.0.47`
portage gentoo	`< 3.0.47`	`3.0.47`

Description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

NVD description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

References

nvd.nist.gov/vuln/detail/CVE-2016-20021 · ADVISORY
gentoo/portage commit 28cd240 · WEB
bugs.gentoo.org/597800 · WEB
gentoo/portage · PACKAGE
pypa/advisory-database · WEB
gitweb.gentoo.org/proj/portage.git/tree/NEWS · WEB
gitweb.gentoo.org/repo/gentoo.git/commit · WEB
wiki.gentoo.org/wiki/Portage · WEB
GitHub Advisory GHSA-pw5x-x5jw-ccmh · ADVISORY

portage 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

portage

PyPI

< 3.0.47

3.0.47

portage

gentoo

< 3.0.47

3.0.47

Description

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.

NVD description