CVEs, backported fixes or not?

[ogghi (David Schmidt)]

Hi there, we are getting our internal infrastructure scanned regularly by Rapid7 and the VM with FreePBX distro installed gets a lot of high risk issues.

Of course it’s in the internal network, but still this should be better?

So I read that there might be fixes back ported, is there an official page indicating this?
Or could I somehow manually upgrade some packages to have versions not vulnerable?

Thanks

[david55]

See:

Any solution to CVE-2022-2068 OpenSSL exploit?

Hello all, I know back in Sept a thread was opened about CVE-2022-2068, but there were only 2 replies and no real solution was given. This is on a high priority from my management, and I was curious to know if there have been any updates to this? My current installed version of openssl is 1.0.2k-fips. Is there a timetable as to when this will get updated? are there alternative ways to mitigate this issue? Any help is bery much appreciated.

for a discussion on the policy on this.