CRITICAL9.8

PYSEC-2024-10

Quick fix

PYSEC-2024-10 — portage: upgrade to the fixed version with the command below.

pip install --upgrade 'portage>=3.0.47'

Details

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/portage

Introduced in: 0Fixed in: 3.0.47

Fixpip install --upgrade 'portage>=3.0.47'

References

https://wiki.gentoo.org/wiki/Portage[WEB]
https://gitweb.gentoo.org/proj/portage.git/tree/NEWS[WEB]
https://bugs.gentoo.org/597800[REPORT]
https://bugs.gentoo.org/597800[FIX]
https://github.com/advisories/GHSA-pw5x-x5jw-ccmh[ADVISORY]