{"action":"Upgrade portage to 3.0.47 or later.","affected":[{"fixed":"3.0.47","introduced":"0"}],"component":"portage","cve_ids":["CVE-2016-20021"],"ecosystem":"PyPI","epss":0.00468,"exploited":false,"fixed_versions":["3.0.47"],"ghsa_id":"GHSA-pw5x-x5jw-ccmh","id":"tcs_01M5KGKW3MMSBGWQG2Z8B7T5S3","modified_at":"2026-06-10T17:01:37.021402273Z","published_at":"2024-01-12T03:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-10","https://wiki.gentoo.org/wiki/Portage","https://gitweb.gentoo.org/proj/portage.git/tree/NEWS","https://bugs.gentoo.org/597800","https://github.com/advisories/GHSA-pw5x-x5jw-ccmh"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-10","url":"https://osv.dev/vulnerability/PYSEC-2024-10"}],"summary":"In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-we"}