A common problem is that Redhat backports security fixes leaving OpenSSH with an old, but not vulnerable, rpm version and ssh version string on Redhat and CentOS. This fools auditors.
Apparently, the solution is to provide the Redhat SAs to the auditor. But which ones? How exactly do I do this? Do I need to compile an SA for every vulnerability?
(What I'm trying at the moment is upgrading to the rpm most recently listed in a SA, then just providing the most recent SA should demonstrate the most recent package fix.)