Description
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
References (3)
Core 3
Core References
Issue Tracking, Patch
https://bugs.gentoo.org/597800
Release Notes
https://gitweb.gentoo.org/proj/portage.git/tree/NEWS
Scores
CVSS v3
9.8
EPSS
0.0004
EPSS Percentile
11.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-347
Status
published
Products (2)
gentoo/portage
< 3.0.47
pypi/portage
0 - 3.0.47PyPI
Published
Jan 12, 2024
Tracked Since
Feb 18, 2026