A vulnerability was discovered in emerge-delta-webrsync and Portage that did not properly validate the revocation status of GPG keys.
A remote attacker could conduct a man-in-the-middle attack. Please review the referenced bug for specific details.