Hi,

I've had a vulnerability scan run against my web server (for PCI DSS compliance) and they've come back with a handful of vulnerabilities. My Linode is running Ubuntu 12.04 LTS and Apache 2.2.22. It appears that most of the CVE's that were found on my server are fixed in later releases of Apache. Running apt-get update / apt-get upgrade --show-upgraded doesn't show anything new to install. I've seen on the apache website that 2.2.29 is the latest version and I assume this will fix all of the vulnerabilities on my server. How do I upgrade from 2.2.22 to 2.2.29?

Thanks,
Mark.

(edit: updated the post title to make this more useful to others who come across the same issue in future!)

Your apache may already be 'patched'. Depending on the vulnerabilities listed by your test... they may not test for the patch... the test may just be looking for the 'version'

http://serverfault.com/questions/533206 ... -to-apache
also
http://serverfault.com/questions/568456 ... e2-for-pci

hope this helps.

Yes! Thanks for that. The second one of those links was spot on - exactly the vuln's the PCI scanner is claiming and, yes, on checking the "Detailed" section of my report, the "evidence" is simply version numbers. My Linode has apache2 2.2.22-1ubuntu1.7 and all the vulns were fixed in either 2.2.22-1ubuntu1.3 or 2.2.22-1ubuntu1.4.

Cheers MotoHoss!

Try changing "ServerTokens" to "Prod" (this hides the version number) and see how the scanner handles that