to be PCI compliant i need to be running openssh 5.8 on a server running ubuntu hardy. editing /etc/apt/sources.list to install openssh-server from natty has way too many unresolved dependencies, i'd need to do a full upgrade.
what are my options?
Your installed version of SSH (mostly) isn't vulnerable to these - your compliance scan is wrong.
Compliance scans which blindly compare CVE lists against software version numbers are mostly worthless when you're using an OS that backports security fixes to stable versions instead of dropping in new major versions of software. Your first step should always be to confirm that you're actually vulnerable.
There is no pre-compiled package of OpenSSH for Ubunty Hardy newer than 4.7p1, so your only choice is to compile the software from source on your own.
The OpenSSH project has a INSTALL file documenting the procedure.
That being said - I take no responsibility if you manage to make your system unreachable. If I really had to do this, then I would enable telnetd (or use the console), remove the installed openssh packages (dpkg -l | grep openssh) and then install by source.
I have no idea if the install script (when compiling from source) gives you proper init scripts to start up sshd at boot, so you might want to check that aswell.
Edit so, now after I took the while to write all that above, it seems like you are trying to upgrade OpenSSH because you think your system has vulnerabilities from 2008. Security fixes are backported to Ubuntu systems via the Ubuntu Security repo, and then via the updates repo for your specific release (in this case, hardy-updates). The latest release for Hardy is 4.7p1-8ubuntu3, which got released March 2, 2011.