Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A security vulnerability was found in Apache in April 2012 that is a PCI compliance issue:

I have always kept my servers (CentOS) up to date with yum. I've been unable to find a repo with httpd-2.2.23 (currently running 2.2.22). It's been a really long time since I've built anything from source so I'm not thrilled about doing it but will if needed.

My question is, how do I go about this and NOT break the yum update process?


share|improve this question

migrated from Oct 24 '12 at 20:49

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 0 down vote accepted

Backup your apache config files, uninstall httpd , httpd-devel and any other httpd package,then you can manually download rpm's from here.

And install it with yum or rpm.

yum localinstall pkg_name
rpm -ivh pkg_name

Hope this helps!

share|improve this answer
The link to is actually a link to an rpm at I'm leery of anything @ .ru additionally, the site is non-responsive. Anywhere else to find the rpm? –  Tim Duncklee Oct 24 '12 at 18:47
you can try to follow instructions from here Other options are compile it by yourself or wait for update –  alan978 Oct 24 '12 at 19:16

You have nothing to do to your server.

According to Red Hat, the versions of Apache shipped with RHEL (and by extension, CentOS) are not vulnerable to this attack.

You do need to provide this information to your PCI compliance auditor.

share|improve this answer
Michael, I wish it were that simple. I can not run the shipping versions that came with stock CentOS due to other software I have to run on the server. Therefore, i have to do the upgrade to be PCI compliant. So far it looks like @alan978 has the best solution. –  Tim Duncklee Oct 24 '12 at 22:34
If you aren't running the Apache that came with CentOS, why does your question imply that you are? You should be specific about the environment if you want an answer that's appropriate to you. –  Michael Hampton Oct 24 '12 at 22:36
Michael, I apologize. I assumed the version number would indicate that I was not running "stock" versions. I will do my best to be clearer from now on. Thx. TD –  Tim Duncklee Oct 25 '12 at 0:14

Don't change anything.

Red Hat (and by extension, CentOS) gets security fixes backported from newer versions, instead of upgrading to newer versions wholesale and potentially introducing compatibility problems.

In this case, there's no backport because the packaged version is not vulnerable. See here; this result from the scan is a false positive.

Raw version number matching for vulnerability checking is often inaccurate; consider changing to ServerTokens Prod.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.