id: PYSEC-2024-10
modified: 2024-01-22T18:22:47.599296Z
published: 2024-01-12T03:15:00Z
aliases:
- CVE-2016-20021
- GHSA-pw5x-x5jw-ccmh
details: 'In Gentoo Portage before 3.0.47, there is missing PGP validation of executed
  code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform
  signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.'
affected:
- package:
    ecosystem: PyPI
    name: portage
    purl: pkg:pypi/portage
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.0.47
  versions:
  - 3.0.18
  - 3.0.19
  - 3.0.20
  - 3.0.21
  - 3.0.22
  - 3.0.23
  - 3.0.24
  - 3.0.25
  - 3.0.26
  - 3.0.27
  - 3.0.28
  - 3.0.29
  - 3.0.30
  - 3.0.31
  - 3.0.32
  - 3.0.33
  - 3.0.34
  - 3.0.35
  - 3.0.36
  - 3.0.37
  - 3.0.38
  - 3.0.38.1
  - 3.0.39
  - 3.0.40
  - 3.0.41
  - 3.0.42
  - 3.0.43
  - 3.0.44
  - 3.0.45
  - 3.0.45.1
  - 3.0.45.2
  - 3.0.45.3
  - 3.0.46
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
references:
- type: WEB
  url: https://wiki.gentoo.org/wiki/Portage
- type: WEB
  url: https://gitweb.gentoo.org/proj/portage.git/tree/NEWS
- type: REPORT
  url: https://bugs.gentoo.org/597800
- type: FIX
  url: https://bugs.gentoo.org/597800
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pw5x-x5jw-ccmh