Vulnerability management · Question 12 of 12
A scanner reports a flaw in the OpenSSL package on a Linux server, but the distribution vendor applied the fix via a backport and the version number stayed the same. What is this, and what should be done?
1 answer is correct. Hard
Show answer
Answer
- B False positive; document it, tune the scanner
Explanation
Scanners that only compare version numbers often do not recognize backports. After checking the vendor advisories, the finding is documented as a false alarm. Authenticated scans with distribution data reduce such cases.