CVE-2016-20021

9.8CRITICAL

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-we

Опубликовано: 1/12/2024Обновлено: 6/3/2025
Посмотреть на NVDПосмотреть на MITRE

Описание

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

ИИ-АнализНа базе ИИ

Затронутые продукты

gentooportage

Ссылки