{"cve":"CVE-2016-20021","nvd":{"published":"2024-01-12T03:15:08.410","modified":"2026-06-17T00:43:06.160","status":"Modified","description":"In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-347"],"references":["https://bugs.gentoo.org/597800","https://gitweb.gentoo.org/proj/portage.git/tree/NEWS","https://wiki.gentoo.org/wiki/Portage","https://bugs.gentoo.org/597800","https://gitweb.gentoo.org/proj/portage.git/tree/NEWS"],"products":["gentoo:portage"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2016-20021","score":0.00468,"percentile":0.40554,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pw5x-x5jw-ccmh","url":"https://osv.dev/vulnerability/GHSA-pw5x-x5jw-ccmh","summary":"Gentoo Portage missing PGP validation of executed code","modified":"2024-08-30T23:57:56.740609Z","packages":[{"ecosystem":"PyPI","name":"portage","purl":"pkg:pypi/portage","ranges":["<3.0.47"],"fixed":["3.0.47"]}]},{"id":"PYSEC-2024-10","url":"https://osv.dev/vulnerability/PYSEC-2024-10","summary":"","modified":"2026-06-10T17:01:37.021402273Z","packages":[{"ecosystem":"PyPI","name":"portage","purl":"pkg:pypi/portage","ranges":["<3.0.47"],"fixed":["3.0.47"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}