We have a client on AMI Linux (Amazon), which is currently using OpenSSL 1.0.1k-15.99.
As far as I can tell Amazon is very good about backporting security patches as per this page: https://alas.aws.amazon.com/ And they have stated in more than one place that they in fact do and will continue to do so per this thread: https://forums.aws.amazon.com/thread.jspa?messageID=759633#759633
The PCI compliance scan failed my client, presumably becasue the version of OpenSSL reported is 1.0.1k. I assume this becasue they list a bunch of CVEs that I know have been patched in the version currently running.
Unfortunately, the scanner's methodology is very opaque, and I can't get a straight answer as the the specific cause of the fail, and neither the credit card processor nor the scanner's tech support are helpful.
If the distro provider backports all the relevent patches to the version they have baked in, is there an actual security risk?
PCI DSS section 6.2 states:
6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches. Install critical security patches within one month of release.
Does my installation of Amazon's latest patches which include their patches to OpenSSL 1.0.1k (which I apply weekly) satisfy this requirement? Or does application of the AMI patches not "count" and they require OpenSSL from the actual "vendor", in this case https://www.openssl.org/ ?
I've asked all these questions of the scanner / credit card processor PCI compliance team and have not received any definitive answers (or really, any answers at all - they don't seem to know the difference between an expired SSL cert on the server and old versions of OpenSSL), and my client is getting antsy.
What is the standard procedure to ameliorate this? I really am not confident in my ability to compile OpenSSL from source, for example.