我们正在使用当前版本的Apache 2.4。 6在Centos 7回购中可用。 装有yum。
我们正在处理PCI合规性，报告说：
IP Address: x Host: x Path: THREAT REFERENCE Summary: vulnerable Apache version: 2.4.6 Risk: High (3) Port: 443/tcp Protocol: tcp Threat ID: web_server_apache_version Details: Apache HTTP Server mod_proxy_fcgi Response Handling Vulnerability 11/21/14 CVE 2014-3583 Apache HTTP Server before 2.4.11 is prone to a vulnerability, which can be exploited to cause a DoS (Denial of Service). The vulnerability exists due to an overflow condition in mod_proxy_fcgi. when handling responses from FastCGI servers. The vulnerability can be exploited by sending a crafted response from a malicious FastCGI server, which could lead to a crash when reading past the end of a heap memory. Apache HTTP Server NULL Pointer Dereference Vulnerability 10/08/14 CVE 2014-3581 Apache HTTP Server 2.4.10 and earlier is prone to a vulnerability, which can be exploited to cause a DoS (Denial of Service). The vulnerability exists because the application contains flaw in the cache_merge_headers_out() function which is triggered when handling an empty 'Content-Type' header value. Multiple Vulnerabilities Fixed in Apache HTTP Server 2.4.10 07/24/14 CVE 2014-0117 CVE 2014-0118 CVE 2014-0226 CVE 2014-0231 CVE 2014-3523 Apache HTTP Server before 2.4.10 is prone to multiple vulnerabilities, which can be exploited to cause a DoS (Denial of Service). The vulnerabilities exist because the application contains flaw in mod_proxy, mod_deflate, mod_status, and mod_cgid modules and in the winnt_accept function of WinNT MPM. Note: the WinNT MPM denial of service vulnerability can only be exploited when the default AcceptFilter is used. Apache HTTP Server Two Denial of Service Vulnerabilities 03/19/14 CVE 2013-6438 CVE 2014-0098 Apache HTTP Server before 2.4.9 is prone to two vulnerabilities, which can be exploited to cause a DoS (Denial of Service). The first vulnerability exists due to an error in the mod_log_config module when logging with truncated cookies. The second vulnerability is due to a boundary error in the mod_dav module when removing leading spaces. HTTP-Basic Authentication Bypass Vulnerability 08/14/09 Apache 2.2.2 and prior are prone to an authentication-bypass vulnerability because it fails to properly enforce access restrictions on certain requests to a site that requires authentication. An attacker can exploit this issue to gain access to protected resources, which may allow the attacker to obtain sensitive information or launch further attacks. Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability 11/03/08 Apache 2.2.9 and prior is prone an unspecified security vulnerability. Information From Target: Service: https Received: Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.13 我们每周更新一次服务器“yum update”
但是当我这样做：rpm -q –changelog httpd | grep的CVE我可以看到这一点：
我如何应用安全扫描所要求的修补程序？ 我无法findrpms来做到这一点。
提前致谢。
问候。
这是使用包pipe理器的问题之一（或者取决于你如何看待它的好处）。
一方面，它们通常是旧版本的应用程序，因此易受攻击（不具备最新function），但另一方面它们是稳定的。 然而，很多供应商（包括Red Hat和基于此的CENTOS）通常为这些版本提供端口必要的修补程序，但这可能对漏洞扫描并不明显。
有人可能会认为像你这样的报告有点懒，因为他们认为当你很容易看到（或者问你是否）使用包pipe理器，然后可以testing看看它是否已经应用了补丁。 这又取决于扫描是如何完成的，以及他们如何确定你所在的版本。 如果他们有权访问您的服务器，那么我会说他们可以证实这一点。 如果他们通过任何其他方式，例如基于您的HTTP头返回，那么我会说他们无法validation你是否已经打补丁，所以他们是正确的提高（顺便说一句，你可能不应该返回特定的版本号如果你是你的HTTP头文件！）。
最后，你应该认识到，这份报告往往是一个可能出现的问题清单，你完全有权返回证据表明你相信这些问题已经得到解决或减轻 – 例如你在问题中提供的证据和事实你有一个定期的补丁时间表…等等。这里仍然存在风险（例如，补丁之间出现的任何风险和/或如果你忘记补丁很长一段时间），任何报告都是正确的，以突出风险，但通常会在报告中减less错误以警告，以突出显示降低的风险。