9.8crit
CVE-2016-20021
Gentoo Portage missing PGP validation of executed code
Also known as GHSA-pw5x-x5jw-ccmh, PYSEC-2024-10
Published 2 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 41%
Public exploits
0
none known
Summary
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
0.47% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | portage | <3.0.47 | 3.0.47 |
Classification
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
References
- wiki.gentoo.org /wiki/Portage · x_transferred
- gitweb.gentoo.org /proj/portage.git/tree/NEWS · x_transferred
- bugs.gentoo.org /597800 · x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-20021 · advisory
- github.com /gentoo/portage/commit/28cd240fb23d880b8641a058831c6762db71c3e2 · web
- github.com /gentoo/portage · package
- github.com /pypa/advisory-database/tree/main/vulns/portage/PYSEC-2024-10.yaml · web
- gitweb.gentoo.org /repo/gentoo.git/commit/?id=5b3c80502e96406b4b175e2ee79eb65f3f3cd9f6 · web
- github.com /advisories/GHSA-pw5x-x5jw-ccmh · advisory
Sources
- CVE List: CVE-2016-20021
- GitHub Advisory: GHSA-pw5x-x5jw-ccmh
- NVD: CVE-2016-20021
- OSV: PYSEC-2024-10
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.