Scan NagiosXI and found several weakness?!

[xpertech]

The IT department through network scanning NagiosXI and found several weakness, how to fix that?

since there're thousands of hosts & services been monitored, if need upgrade, will it cause some monitoring damaged?

[benjaminsmith]

Hi @Xpertech,

Thanks for posting the screenshot of your system profile. Can you provide us some details regarding the scan for us to review.

Thanks.

[xpertech]

Here's the scan information.

[mcapra]

I am not your org's security expert. This is not authoritative in any way.

Without knowing more about the scanning utility used, it's hard to say for sure what's going on.

I haven't looked at all of the CVEs, but every single one I've skimmed has a corresponding RHEL errata or CentOS tracker entry with patch date. Example:
https://bugs.centos.org/view.php?id=14530

If this scanner is blindly flagging CVEs based exclusively on PHP versions, rather than actually verifying and reproducing CVEs, I would suggest the IT team review RedHat's policy regarding PHP security:
https://access.redhat.com/security/updates/backporting

[lmiltchev]

@mcapra is correct - the patches are backported by the OS and should not be an issue.