Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running: CentOS 5.6

I have been on Google and reading all weekend on trying to update Apache to the latest version (2.2.19), but am now a little confused. Does the CentOs version 2.2.3 include backported security patches and so "yum update" will keep that up to date?



share|improve this question
up vote 1 down vote accepted

Red Hat Enterprise Linux — and thus its derivatives, including CentOS — is a "stable" Linux, meaning that Red Hat generally doesn't add new features within a major revision.[*] They backport security and bug fixes only, applying them to the version of each package that was originally shipped. This is a good thing for organizations and users that have a low tolerance for things breaking just because there was a security update.

One of the reasons Fedora exists is to be the bleeding edge test bed for all the new features in Apache and every other package Red Hat ships, plus packages they're considering shipping in the future. If you absolutely need a new feature or behavior change introduced between Apache 2.2.3 and 2.2.19, you might be better off using Fedora or another bleeding-edge Linux distro, rather than try to drag CentOS forward.

Sometimes you can find third-party RPM repositories with newer versions of certain packages. I use Repoforge and EPEL most often, and neither is currently shipping a newer Apache for EL5.

[*] The upgrade from Firefox 2 to 3.6 in RHEL 5.6 is a notable deviation from this policy. I guess they ran into a situation where it was just too painful to keep backporting patches between such different versions.

share|improve this answer

Yes, CentOS (via RHEL) provides security patches for their released version of Apache. You can verify which CVEs have been patched in your currently installed package version via the changelog.

share|improve this answer
Thanks for the quick reply @womble and advice on checking the changelog, will take a look at that now. – James Monty Aug 8 '11 at 8:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.