Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in.
I understand that CentOS derives most of it's packages from RHEL, which has that kind of page here: https://access.redhat.com/security/cve/
Unfortunately though it looks like CentOS takes the RHEL version numbers and changes them, so it's not possible to check what base version of the RHEL package it came from and whether a particular CVE is fixed in the CentOS package.
As an example, can anyone tell me what version of OpenSSH in CentOS fixes CVE-2014-2653? Is there an easy way (similar to the Red Hat site) to find that info for any CVE and any CentOS package?