I'm running OpenSSH 5.3p1-81.el6_3, which according to my server is the latest stable version. My PCI scan is showing CVE-2010-4478 and CVE-2011-0539 exploits as being present due to my OpenSSH version.
Checking "rpm -q --changelog openssh" shows that there have been updates as late as october 2012. Surely these have been resolved? There are newer versions of SSH (6.x I believe) but from what I can tell, rehat/centos backports security fixes to old stable versions like 5.3.
Are these fixed in my version or aren't they? If yes, how can I show this to my PCI scanner to prove a false positive?
Thanks!