CVE-2002-2204

CVE-2002-2204 describes a vulnerability in RPM Package Manager 4.0.4, specifically affecting Red Hat products, where the default --checksig setting validates a package's signature without identifying the signer. This allows remote attackers to disguise malicious packages as legitimate, originating from trusted sources. The vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial confidentiality, integrity, and availability impacts. Despite its age and severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.