CVE-2016-20021

The emerge-webrsync tool downloads a .gpgsig file containing a PGP signature, however it does not perform actual verification of this signature. This means that the downloaded and executed code is not checked for authenticity and integrity. An attacker who can intercept or modify downloaded data (e.g. through a man-in-the-middle attack or compromise of the source server) can deliver malicious code that will be executed without warning.

An attacker can cause arbitrary code execution on the system of a user using emerge-webrsync, which can result in complete system takeover, breach of confidentiality and data integrity.

Gentoo Portage should be updated to version 3.0.47 or later. Details available in the vendor references: https://gitweb.gentoo.org/proj/portage.git/tree/NEWS. Until the update is applied, avoid using the emerge-webrsync tool.

Gentoo Portage in versions before 3.0.47, only when the emerge-webrsync tool is used. Standard Portage use without emerge-webrsync is not vulnerable.