CentOS

Dear all, hello.

I connected the epel-release repository. I installed httpd and php from this repository.
Information Security Department found that these are older versions of httpd and php in this repository. They are asked to update to the latest versions.

How can I do that? There are no fresh versions in epel-release. Maybe there are other official repositories for CentOS. Or can I add a repository from Red Hat?

EPEL does not have httpd or php, because EPEL does not overwrite packages that are in CentOS.

You should read https://access.redhat.com/security/updates/backporting -- Red Hat backports security fixes.

Hm, I understand a certain version of CentOS \ RH includes certain versions of apache \ php. And the more recent ones are only delivered with the new version of the distribution. Right?

Correct. However Redhat backport any security patches from newer versions to the one that ships as part of the distro. The backports link that you were given has more details on that and on the ways in which you can find out if a particular CVE is fixed or not.

> And the more recent ones are only delivered with the new version of the distribution. Right?

Indeed, the version in base repository stay the same.

Since C6, newer versions of various software are available as "Software Collections" (MariaDB 10.x, Mongodb 3.x, PHP 7.0 and 7.1, Apache 2.4, etc), which allow parallel installation, and don't alter base system.

See the full list on https://access.redhat.com/documentation ... ase_notes/

About PHP, you can read https://developers.redhat.com/blog/2017 ... tion-tips/