CVE-2016-20021 is a critical severity (CVSS 9.8) flaw in Gentoo Portage before 3.0.47. The standalone emerge-webrsync tool downloaded a PGP signature file but never checked it, so the downloaded tree was trusted without proof. Portage 3.0.47 added the verification, so upgrade to it or a later release.
What's affected
Gentoo Portage before 3.0.47. The record is explicit about scope: unless emerge-webrsync is used, Portage is not vulnerable. So the exposure is limited to systems that sync the package tree with the standalone emerge-webrsync tool.
The fix is documented in the Portage NEWS file. The entry for portage 3.0.47, dated 30 April 2023, says the standalone emerge-webrsync now verifies PGP signatures, and refers to Gentoo bug 597800. It adds that sync-type set to webrsync in repos.conf already handled PGP verification when configured to do so, and by default.
The weakness is CWE-347, improper verification of a cryptographic signature. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. I found no other severity figure in the sources, so there is no conflict to report. The scope note in the record, that only the standalone tool is affected, is the thing to weigh against the 9.8.
How to check if you're exposed
First check the version:
emerge --version
That prints the Portage version. Anything below 3.0.47 predates the fix.
Then check whether you use the standalone tool. Look in your scheduled jobs, your provisioning scripts and your shell history for emerge-webrsync:
grep -r emerge-webrsync /etc/cron* /etc/portage /usr/local 2>/dev/null
If neither the tool nor a cron job runs it, the record says Portage is not vulnerable. If your repos.conf uses the built in webrsync sync type, the NEWS entry says it already verified signatures by default.
What to do now
- Upgrade Portage to 3.0.47 or later through your normal Gentoo update process.
- Find scripts, images and automation that call emerge-webrsync directly, and update the Portage inside those images.
- Prefer the regular sync mechanism with signature verification enabled, which the NEWS entry says is the default for the webrsync sync type.
- Rebuild any long lived container or machine image that was created from an old Portage snapshot.
- Read the later NEWS entries as well. The 3.0.69 notes describe further emerge-webrsync security fixes, so aim for a current release, not only 3.0.47.
Why it matters
A package manager runs code that came from a network. When the signature that proves the source is downloaded but never checked, the download is trusted on faith. Anyone able to alter the content in transit or on a mirror could have it accepted. That is the point of the 9.8 score, which assumes no privileges and no user interaction.
The record was published in January 2024, after the fix in 3.0.47. This CVE is not on the CISA Known Exploited Vulnerabilities list, and I read nothing saying it was exploited in the wild.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, which helps when you are not sure what a codebase pulls in.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Portage version fixes CVE-2016-20021?
Portage 3.0.47. Its NEWS entry says the standalone emerge-webrsync now verifies PGP signatures.
Am I affected if I never run emerge-webrsync?
According to the record, no. Unless emerge-webrsync is used, Portage is not vulnerable. Upgrade anyway as part of normal maintenance.
Sources
Last reviewed: 19 October 2026.
