-1

I am using

Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux

Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I installedhttpd version to httpd-2.4.6-80.el7_5.1.x86_64. But it have still some vulnerability. See here.

My question is that how can I mitigate vulnerability noted in the site.

Improve this question
6
  • 4
    The Linux kernel version has nothing to do with vulnerabilities in httpd. Also, you claim that the version you use has some vulnerabilities by simply linking to the document which lists all vulnerabilities in Apache 2.4 - several of these don't affect Apache 2.4.6 at all. It is also unclear which of the vulnerabilities are relevant in the context of what you do. And the critical fixes probably got backported anyway - please check yourself. In summary: I think the question is too broad.
    – Steffen Ullrich
    Jun 29, 2018 at 9:40
  • Ok. I understand your point. But RHEL 7 does allows latest version of httpd. I am doing research on CVE which can affect my system.
    – again
    Jun 29, 2018 at 9:53
  • 3
    You might want to read Apache httpd versions supported in Red Hat Enterprise Linux which explains which versions of Apache or supported on which versions of RedHat and also specifically addresses the typical question that users claim that they need to have the latest 2.4.x version since they don't understand that security fixes gets backported.
    – Steffen Ullrich
    Jun 29, 2018 at 10:17
  • 2
    RHEL tends to backport patches, so you're not really dealing with 2.4.6, you're dealing with 2.4.6 with it's 80th patch. To see if a vulnerability has been fixed, run rpm -qa --changelog httpd | grep -ei cve -ei can and compare to the list that you linked it.
    – Some Linux Nerd
    Jun 29, 2018 at 20:09
  • 1
    @SomeLinuxNerd: grep -ei pat doesn't work; -e pat -i or -ie pat does, and -ie pat1 -e pat2 -e pat3 applies the -i to all patterns.
    – dave_thompson_085
    Jun 30, 2018 at 3:39

1 Answer 1

Reset to default
2

If you are concerned about the security of a system, then you should understand how the vendor manages updates.

The reason most people would choose RHEL/Centos/Suse over Debian/Ubuntu/Arch/Gentoo is that the former publish distributions around a collection of software with a well-defined upgrade timetable/path. RedHat and co would not stay in business very long if they were selling vulnerable software, so in order to ensure the continued security of their distribution while not undermining their customers efforts, they will backport security fixes from upstream releases into the version they include in their distribution(s).

Yes, you can uninstall the RPM and either link to an unofficial repo with the latest versions of software, or compile from source yourself, but in both cases the software is no longer covered by your support agreement with RedHat, and in the latter case requires regular effort to ensure the software is up to date.

Improve this answer
4
  • Small typo (not worth a suggested edit): "RedHat and co would not stay in business very ..." (missing a t at stay)
    – Tensibai
    Jun 29, 2018 at 13:52
  • Debian (and Ubuntu) also backports security fixes
    – dave_thompson_085
    Jun 30, 2018 at 3:39
  • How actually Red Hat backport? Would please explain. I have gone through the link before.
    – again
    Jul 2, 2018 at 4:57
  • If they're luck, by running a diff between the fixed bersion of code and the version immediately before to get a patch then applying the patch to the source of the package version, adding a test case to the makefile and recompiling.
    – symcbean
    Jul 2, 2018 at 8:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.