CVE-2016-20021: Gentoo Portage missing PGP validation of executed code

Severity: Critical

CVSS Score: 9.8

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.