updating apache, openssl?

June 2, 2015 2k views
Apache Security
info301725
By:
info301725

your current centos 7 distro is not updated with the most current packages, YUM does not fetches the most current version.... as a result i am left with some security vulnerabilities ..

how would i update Apache?

High
1
OpenSSL Running Version Prior to 1.0.1i

Medium
6
Apache Running Version Prior to 2.4.12
OpenSSL Running Version Prior to 1.0.1j (POODLE)
Apache Running Version Prior to 2.4.8
Apache NULL Pointer Dereference DoS
Apache Running Version Prior to 2.4.10
OpenSSL Running Version Prior to 1.0.1h

Low
8
OpenSSL Version Detection
IMAP Service STARTTLS Command Support
SMTP Service STARTTLS Command Support
TCP Timestamps Retrieval
HTTP Packet Inspection
HTTP TRACE Method XSS Vulnerability
Directory Scanner
ICMP Timestamp Request
Gravatar

Log In to Comment
1 Answer
ryanpq MOD June 2, 2015

All major distributions provide security updates for their distributions. In many cases these security updates take the shape of patches for older versions rather than a new version. Since supporting newer versions of software may not be possible on older releases patches are back-ported to resolve known security vulnerabilities and issues.

Software and services that perform security assessments based solely on version numbers will report out of date software despite backported patches having been deployed. You can read more about this common practice here.

tldr - If you have a security repository on yum or apt (as there is by default) and keep up to date on patches you should not have a problem.

Reply
Have another answer? Share your knowledge.

Related Questions