Software versions for FreePBX 14 and the SNG7 distro

[Marbled (Nicolas Riendeau)]

Hi!

@rnmixon

We just had a security audit and a number of vulnerabilities were flagged on our FreePBX 13 install, related to running an older apache httpd version - 2.2.15. Here’s an example:

Was this

Response to security patch request?

One thing you will also want to look into is Red Hat back-ports security releases, without bumping the release number. So you may already be okay, read this article for details: https://access.redhat.com/security/updates/backporting/?sc_cid=3093

taken into account or did they simply checked the version number?

As Tony so eloquently put it the last time something like this came up, ie

Response to security patch request?

This is a BS audit. All they do is look for CVEs and say PHP version blah has these vulnerabilities but Red Hat back ports all security vulnerabilities into their version of PHP and apache and hence they make their way into Centos and us and everyone else based on RHEL. This is a audit firm who doesn’t understand backports. Have them prove a vulnerability exist with a exploit.

that audit does not mean much if how Red Hat handles security backports was not taken into account…

Good luck and have a nice day!

Nick