CVE-2016-20021
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verific…
Published: 2024-01-12 · CVSS: 9.8 · CVSS 3.1
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7