CVE-2016-20021 Gentoo Portage missing PGP validation of executed code
CriticalCVSS 9.8
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi portage(PyPI) | < 3.0.47 | 3.0.47 |
| pypi portage(PyPI) | = 3.0.18 | No fix listed |
| pypi portage(PyPI) | = 3.0.19 | No fix listed |
| pypi portage(PyPI) | = 3.0.20 | No fix listed |
| pypi portage(PyPI) | = 3.0.21 | No fix listed |
| pypi portage(PyPI) | = 3.0.22 | No fix listed |
| pypi portage(PyPI) | = 3.0.23 | No fix listed |
| pypi portage(PyPI) | = 3.0.24 | No fix listed |
| pypi portage(PyPI) | = 3.0.25 | No fix listed |
| pypi portage(PyPI) | = 3.0.26 | No fix listed |
| pypi portage(PyPI) | = 3.0.27 | No fix listed |
| pypi portage(PyPI) | = 3.0.28 | No fix listed |
| pypi portage(PyPI) | = 3.0.29 | No fix listed |
| pypi portage(PyPI) | = 3.0.30 | No fix listed |
| pypi portage(PyPI) | = 3.0.31 | No fix listed |
| pypi portage(PyPI) | = 3.0.32 | No fix listed |
| pypi portage(PyPI) | = 3.0.33 | No fix listed |
| pypi portage(PyPI) | = 3.0.34 | No fix listed |
| pypi portage(PyPI) | = 3.0.35 | No fix listed |
| pypi portage(PyPI) | = 3.0.36 | No fix listed |
| pypi portage(PyPI) | = 3.0.37 | No fix listed |
| pypi portage(PyPI) | = 3.0.38 | No fix listed |
| pypi portage(PyPI) | = 3.0.38.1 | No fix listed |
| pypi portage(PyPI) | = 3.0.39 | No fix listed |
| pypi portage(PyPI) | = 3.0.40 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi portage(PyPI) | = 3.0.41 | No fix listed |
| pypi portage(PyPI) | = 3.0.42 | No fix listed |
| pypi portage(PyPI) | = 3.0.43 | No fix listed |
| pypi portage(PyPI) | = 3.0.44 | No fix listed |
| pypi portage(PyPI) | = 3.0.45 | No fix listed |
| pypi portage(PyPI) | = 3.0.45.1 | No fix listed |
| pypi portage(PyPI) | = 3.0.45.2 | No fix listed |
| pypi portage(PyPI) | = 3.0.45.3 | No fix listed |
| pypi portage(PyPI) | = 3.0.46 | No fix listed |
| gentoo portage | < 3.0.47 | 3.0.47 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.gentoo.org issue-tracking patch
- github.com product
- github.com
- gitweb.gentoo.org release-notes
- gitweb.gentoo.org
- wiki.gentoo.org product
- github.com vendor-advisory