Move off end-of-life software on Apache

Why it matters

The software versions named in the finding no longer get security fixes from their vendor or from any long-term distribution, so every hole found from now on stays open. Moving to a supported release is the only fix; hiding the version number does not help.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find out where Apache comes from. If it is your Linux distribution's package, upgrade the operating system to a supported release (for example with do-release-upgrade on Ubuntu, or a new server with the current release), which brings a maintained Apache 2.4.
2. If you build Apache yourself, move to the current 2.4 release from httpd.apache.org (and keep updating it), or switch to the distribution package so security fixes arrive with the system updates.
3. Test the configuration with apachectl configtest on the new system, switch over, and rescan. Hide the exact version afterwards with ServerTokens Prod, which is good practice but not a fix.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cms and framework advisories check
• Keep the software named in the finding up to date
• Update the CMS or application to a patched release
• Patch the exploited vulnerability in your CMS or application
• Update WordPress to the current release