Take the 2-minute tour ×  I'm running OpenSSH 5.3p1-81.el6_3,
which according to my server is the latest stable version. My
PCI scan is showing CVE-2010-4478 and CVE-2011-0539 exploits as
being present due to my OpenSSH version.  Checking "rpm -q
--changelog openssh" shows that there have been updates as late
as october 2012. Surely these have been resolved? There are
newer versions of SSH (6.x I believe) but from what I can tell,
rehat/centos backports security fixes to old stable versions
like 5.3.  Are these fixed in my version or aren't they? If yes,
how can I show this to my PCI scanner to prove a false positive?
share|improve this question add comment  1 Answer  up vote 5
down vote accepted  Yes, you are up to date, and not vulnerable
to these particular vulnerabilities.  To resolve this, you need
to look up each CVE at Red Hat and note the status of the
package. In some cases, a backported fix will be available. In
others, the package won't be vulnerable because of various
factors (for instance, the