rpm: incorrect signature checking

From the Ubuntu advisory:

It was discovered that RPM incorrectly handled signature checking. An attacker could create a specially-crafted rpm with an invalid signature which could pass the signature validation check.