-1

I am using

Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux

Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I installedhttpd version to httpd-2.4.6-80.el7_5.1.x86_64. But it have still some vulnerability. See here.

My question is that how can I mitigate vulnerability noted in the site.

|improve this question
  • 4
    The Linux kernel version has nothing to do with vulnerabilities in httpd. Also, you claim that the version you use has some vulnerabilities by simply linking to the document which lists all vulnerabilities in Apache 2.4 - several of these don't affect Apache 2.4.6 at all. It is also unclear which of the vulnerabilities are relevant in the context of what you do. And the critical fixes probably got backported anyway - please check yourself. In summary: I think the question is too broad. – Steffen Ullrich Jun 29 '18 at 9:40
  • Ok. I understand your point. But RHEL 7 does allows latest version of httpd. I am doing research on CVE which can affect my system. – again Jun 29 '18 at 9:53
  • 3
    You might want to read Apache httpd versions supported in Red Hat Enterprise Linux which explains which versions of Apache or supported on which versions of RedHat and also specifically addresses the typical question that users claim that they need to have the latest 2.4.x version since they don't understand that security fixes gets backported. – Steffen Ullrich Jun 29 '18 at 10:17
  • 2
    RHEL tends to backport patches, so you're not really dealing with 2.4.6, you're dealing with 2.4.6 with it's 80th patch. To see if a vulnerability has been fixed, run rpm -qa --changelog httpd | grep -ei cve -ei can and compare to the list that you linked it. – Some Linux Nerd Jun 29 '18 at 20:09
  • 1
    @SomeLinuxNerd: grep -ei pat doesn't work; -e pat -i or -ie pat does, and -ie pat1 -e pat2 -e pat3 applies the -i to all patterns. – dave_thompson_085 Jun 30 '18 at 3:39
2

If you are concerned about the security of a system, then you should understand how the vendor manages updates.

The reason most people would choose RHEL/Centos/Suse over Debian/Ubuntu/Arch/Gentoo is that the former publish distributions around a collection of software with a well-defined upgrade timetable/path. RedHat and co would not stay in business very long if they were selling vulnerable software, so in order to ensure the continued security of their distribution while not undermining their customers efforts, they will backport security fixes from upstream releases into the version they include in their distribution(s).

Yes, you can uninstall the RPM and either link to an unofficial repo with the latest versions of software, or compile from source yourself, but in both cases the software is no longer covered by your support agreement with RedHat, and in the latter case requires regular effort to ensure the software is up to date.

|improve this answer
  • Small typo (not worth a suggested edit): "RedHat and co would not stay in business very ..." (missing a t at stay) – Tensibai Jun 29 '18 at 13:52
  • Debian (and Ubuntu) also backports security fixes – dave_thompson_085 Jun 30 '18 at 3:39
  • How actually Red Hat backport? Would please explain. I have gone through the link before. – again Jul 2 '18 at 4:57
  • If they're luck, by running a diff between the fixed bersion of code and the version immediately before to get a patch then applying the patch to the source of the package version, adding a test case to the makefile and recompiling. – symcbean Jul 2 '18 at 8:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.