CVE:CVE-2002-2204
CNNVD:CNNVD-200212-462
RPM Package Manager 4.0.4版本的默认--checksig设置不用列出签名者就检测包的签名是有效的，远程攻击者使其看起来是一个来自于值得信赖的源的恶意包。
solution:Upgrade redhat redhat_package_manager to a higher version than 4.0.2-71,4.0.2-72,4.0.3,4.0.4,and avoid the version 4.0.2-71,4.0.2-72,4.0.3,4.0.4