Yum Update Issue – Fixing Yum Not Updating Httpd Past Version 2.2.3 on CentOS

Red Hat Enterprise Linux — and thus its derivatives, including CentOS — is a "stable" Linux, meaning that Red Hat generally doesn't add new features within a major revision.[*] They backport security and bug fixes only, applying them to the version of each package that was originally shipped. This is a good thing for organizations and users that have a low tolerance for things breaking just because there was a security update.

One of the reasons Fedora exists is to be the bleeding edge test bed for all the new features in Apache and every other package Red Hat ships, plus packages they're considering shipping in the future. If you absolutely need a new feature or behavior change introduced between Apache 2.2.3 and 2.2.19, you might be better off using Fedora or another bleeding-edge Linux distro, rather than try to drag CentOS forward.

Sometimes you can find third-party RPM repositories with newer versions of certain packages. I use Repoforge and EPEL most often, and neither is currently shipping a newer Apache for EL5.

[*] The upgrade from Firefox 2 to 3.6 in RHEL 5.6 is a notable deviation from this policy. I guess they ran into a situation where it was just too painful to keep backporting patches between such different versions.

As far as security fixes are concerned, you're all set; your compliance scanner is the one that's wrong.

A lot of those scanners do their vulnerability detection via a check of the version string (in this case, a check of the string that OpenSSH sends to connecting clients including its version), which often leads to false positives when those scanners assume "issue X was fixed in OpenSSH version 5.whatever). Try changing an Apache server to ServerTokens Major and watch the scanner light up with a bunch of 2.0 vulnerabilities, regardless of what version you're actually on.

Figure out exactly what vulnerabilities the scan thinks you have, find them in the RPM's changelog, and send your scan vendor the version that you're on as proof that the scan's detection is a false positive. And this link, for good measure.