Security Advisory
CVE-2016-20021
9.8
CRITICAL
Vulnerability Description
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
Published Date
January 12, 2024
Official Source
NIST NVD Advisory