# Vulnerabilities of Apache and OpenSSL in Rocky 8.6

**URL:** <https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173>\
**Category:** Rocky Linux Help & Support\
**Created:** [June 5, 2023, 3:31am UTC](https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173 "2023-06-05T03:31:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tmchan0003](https://avatars.discourse-cdn.com/v4/letter/t/bc8723/32.png) [@tmchan0003](https://forums.rockylinux.org/u/tmchan0003)\
**Post date:** [June 5, 2023, 3:31am UTC](https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173/1 "2023-06-05T03:31:26Z")

</div>

Hi Support,

I found that there are several vulnerabilities for Apache and OpenSSL in Rocky 8.6 by third-party vulnerability scanning system as follows:-

For Apache:-  
CVE-2019-0217  
CVE-2019-0220  
CVE-2019-10092  
CVE-2019-10098  
CVE-2020-1934  
CVE-2022-22721  
CVE-2022-26377  
CVE-2022-28614  
CVE-2022-28615  
CVE-2022-31813

For OpenSSL:-  
CVE-2023-0215

And, I checked the exact installed version of Apache2 and OpenSSL by using “dnf list installed” as follows:-

httpd.x86\_64 2.4.37-47.module+el8.6.0+985+b8ff6398.2  
openssl.x86\_64 1:1.1.1k-7.el8\_6

I would like to know where to find the change log for both Apache (2.4.37-47.module+el8.6.0+985+b8ff6398.2) and OpenSSL (1:1.1.1k-7.el8\_6) so that I can confirm whether the above CVEs can be solved or not?

Many thanks

---

<div class="post-metadata">

**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\
**Post date:** [June 5, 2023, 3:48am UTC](https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173/2 "2023-06-05T03:48:57Z")

</div>

The change log can be found by running `rpm -q httpd --changelog` and `rpm -q openssl --changelog`.

8.6 [is no longer in support](https://wiki.rockylinux.org/rocky/version/#example-an-unsupported-release). You are recommended to update to full by running `dnf update` to get to Rocky Linux 8.8. Doing so will resolve most security issues.

In the event the security scanner points out CVE’s, I encourage you to:

- check the change log with the commands above
- attempt to find each CVE, and in the event you cannot, search for them [here](https://access.redhat.com/security/security-updates/cve) and see if it affects you or not
- Review how backports work in Enterprise Linux [here](https://access.redhat.com/security/updates/backporting/).

---

<div class="post-metadata">

**Author:** ![tmchan0003](https://avatars.discourse-cdn.com/v4/letter/t/bc8723/32.png) [@tmchan0003](https://forums.rockylinux.org/u/tmchan0003)\
**Post date:** [June 5, 2023, 4:06am UTC](https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173/3 "2023-06-05T04:06:14Z")

</div>

Hi nazunalika,

Many thanks 😃

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\
**Post date:** [August 25, 2023, 3:11am UTC](https://forums.rockylinux.org/t/vulnerabilities-of-apache-and-openssl-in-rocky-8-6/10173/4 "2023-08-25T03:11:52Z")

</div>