I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o.
rpm -q openssl shows: openssl-0.9.8e-12.el5_5.7
The apache header banner shows: Server: Apache/1.3.41 (Unix) PHP/5.2.14 mod_psoft_traffic/0.2 mod_ssl/2.8.31 OpenSSL/0.9.8b mod_macro/1.1.2
(note: that apache banner is not even showing the the installed version)
openssh and php have a similar situation (reported version is less than the minimum for PCI compliance).
Do I need to build all these libraries from source to get them on the latest version? Or is there a way to tell CentOS yum to install the new version instead of their back-ported patched version? I'd rather not go outside yum if possible so future maintenance will be simplified