I am going through a long list of 100s of security issues that a provider of PCI compliance security scan services reported on a client server. I have found, isolated, documented, and filed disputes for all false positives. I am unsure if I should love or hate this company. They certainly do their share to provide job security, but I'd prefer work that is a bit more interesting.In any case, https://access.redhat.com/security/cve/cve-2014-8109 is the last item that I cannot resolve.RedHat decided not to backport the fix to RHEL 7, and consequently, this hole was not plugged.I am looking for advice on two thingsCan I do anything to mitigate this (a compensating control)? Short of rebuilding httpd, hopefully?Is there a factual technical argument to be had with the this service provider about the merit of this issue?
CVE-2014-8109 and CentOS
centos;security;apache httpd