PCI Compliance Scans - False Positives
PCI compliance scans can sometimes report issues that may not truly affect your website’s security. These false positives occur because the scanner relies on version numbers to detect vulnerabilities, which may not reflect the actual security state of the server. Many servers, especially those managed by hosting providers and enterprise-level operating systems, receive security updates through backporting—where fixes are applied without changing the software version number.
You can use the information in the table below to identify and report these false positives to your PCI compliance provider. If you are not sure what a PCI scan covers or whether you need one, start with PCI Compliance.
Server names and IP addresses in the examples below are placeholders. The evidence itself is accurate, but the specific host each command was run on has been replaced. If your compliance provider needs output from the exact server your account sits on, open a support ticket and we will supply it.
Title | CVE Number | Reason |
CPE Based Vulnerabilities for OpenSSH | CVE-2023-51767 | Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. https://access.redhat.com/security/cve/cve-2023-51767 Furthermore, we use Samsung DDR4/5 memory, which has had Target Row Refresh (TRR) enabled since 2014. We have also run the RowHammer test provided by Google (https://github.com/google/rowhammer-test) against this hardware. |
CPE Based Vulnerabilities for OpenSSH | CVE-2020-15778 | To exploit this SERVER vulnerability in SCP, a bad actor would first have to obtain the username and either the password or an authorised private key. Should an attacker gain access to those credentials, then they would already enjoy full access to the account via other SSH methods on the same TCP port, so this SCP vulnerability in itself does not provide the attacker with any increase in privileges. It remains the responsibility of the CLIENT to prove they have adequately audited policies and procedures in place to ensure the safety of any passwords or private keys associated with their account. This much is beyond the scope of Krystal Hosting. While Krystal Hosting accept incoming SCP connections to this server from internal automation systems, those connections are only accepted from known host addresses using key based authentication to unprivileged accounts with no access to card data. |
CPE Based Vulnerabilities for OpenSSH | CVE-2019-6110 CVE-2019-6111 CVE-2019-6109 CVE-2018-20685 | These are CLIENT vulns. The client does not make outbound SSH connections of any kind FROM this server, and are therefore not at risk. Krystal Hosting make outbound connections to hosts on their internal/ network only, and then only using key pairs and where the host fingerprint is already validated through internal processes. Such client connections are made from unprivileged account with no access to card data. |
CPE Based Vulnerabilities for OpenSSH | CVE-2021-41617 | None of the directives that makes our server vulnerable are enabled: [root@server ~]# grep '^AuthorizedKeysCommand' /etc/ssh/sshd_config |
CPE Based Vulnerabilities for OpenSSH | CVE-2019-16905 | The versions of OpenSSH shipped with Red Hat (Including Almalinux), do not enable support for XMSS and therefore are not affected by this flaw. |
CPE Based Vulnerabilities for OpenSSH | CVE-2020-14145 | This CVE has been patched from upstream by red hat, the patch is applied on our server as you can see below: [root@server ~]# rpm -qa --changelog openssh | grep -i CVE-2020-14145 |
CPE Based Vulnerabilities for OpenSSH | CVE-2007-2768 | OPIE for PAM is not shipped with AlmaLinux 8 and is therefore not vulnerable: [root@server ~]# find /etc/pam.d -type f -exec grep -nHe "opie" {} ";" |
CPE Based Vulnerabilities for OpenSSH | CVE-2016-20012 | This is disputed https://access.redhat.com/security/cve/CVE-2016-20012 https://www.cve.org/CVERecord?id=CVE-2016-20012 Although a CVE was assigned upstream and Red Hat doesn't consider it to be a security flaw and won't receive any patch, also the CVE was made as disputed by MITRE. Considering that Red Hat is closing this flaw as NOTABUG. |
CPE Based Vulnerabilities for OpenSSH | CVE-2017-15906 | This fix has been backported: [root@server ~]# rpm -qa --changelog openssh | grep CVE-2017-15906 |
CPE Based Vulnerabilities for OpenSSH | CVE-2023-38408 | Backported [root@server ~]# rpm -q --changelog openssh| grep CVE-2023-38408 |
CPE Based Vulnerabilities for OpenSSH | CVE-2018-15919 | Not vulnerable: [root@server ~]# grep '^GSSAPIAuthentication' /etc/ssh/sshd_config GSSAPIAuthentication no |
CPE Based Vulnerabilities for OpenSSH | CVE-2007-2243 | Not vulnerable: [root@server ~]# grep '^ChallengeResponseAuthentication' /etc/ssh/sshd_config |
CPE Based Vulnerabilities for OpenSSH | CVE-2021-36368 | This is disputed: https://nvd.nist.gov/vuln/detail/CVE-2021-36368 The attack requires that the host node is already compromised in a way where attackers can modify the config. Our servers Use Cloudlinux so all permissions and processes and run inside a cage so no client user could make changes to the system config. As well as that, we do also maintain the SSH config so if there were any changes made, this would reset. |
CPE Based Vulnerabilities for OpenSSH | CVE-2008-3844 | This only affects Redhat versions 4 and 5: |
CPE Based Vulnerabilities for OpenSSH | CVE-2023-51384 | This vulnerability only applies to instances where destination constraints are defined and multiple keys are returned from a PKCS#11 token. Use of regular private keys, FIDO tokens and unconstrained keys are unaffected. The affected functionality was added only in OpenSSH 8.9, we have earlier version in Red Hat Enterprise Linux 6, 7, 8 and 9. |
CPE Based Vulnerabilities for OpenSSH | CVE-2024-3094 | This was an edge-case vulnerability that only affected hosts running beta or rolling releases. AlmaLinux and CentOS were not affected, as both sit downstream of the affected release. |
CPE Based Vulnerabilities for OpenSSH | CVE-2023-51385 CVE-2023-48795 | [root@server ~]# rpm -q --changelog openssh| grep -A 3 Terrapin |
CPE Based Vulnerabilities for OpenSSH | CVE-2024-6387 | [root@server ~]# rpm --changelog -q openssh-8.7p1-38.el9.alma.2.x86_64| less |
Exim | CVE-2023-51766 | This was fixed in cPanel 116.0.11 and has been included in every release since. [root@server ~]# rpm -q --changelog cpanel-exim | grep 51766 |
HSTS Missing From HTTPS Server | N/A | HSTS can be added at the site level by adding the following line to your site's Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" The double quotes matter. The value contains a space, so without them Apache treats Only add |
SMTP Server Non-standard Port Detection | N/A | - Port 525 is an intentionally open port. - Our hosting SMTP daemon simply listens on TCP/525 additionally to TCP/25 because some of our client's ISPs restrict their port 25 connectivity to their own mail services. - Authentication for relaying remote domains requires username/password. - Relaying for remote domains requires the connection be elevated to TLS BEFORE authentication is accepted. - The port is filtered against known bad actors. |
Cookie Does Not Contain The "secure" Attribute | N/A | Please report these as false positives, on the basis that requests received to ports 2082, 2086, 2095. are replied with nothing more than a redirection to the service's secure HTTPS port. e.g. 2082, 2086, 2095 are non-SSL ports that redirect the user to 2083, 2087, 2096 respectively. There is no application, or processing of any submitted data other than the connecting host's connection details. |
Database Reachable from the Internet | N/A | Although port 3306 responds, MySQL is not reachable as per the following output: $ telnet 192.0.2.10 3306 |
Multiple Mail Server EXPN/VRFY Information Disclosure (Port 587) | N/A | EXPN and VRFY are disabled on the fleet. Can be verified with Telnet by running $ telnet mail.example.co.uk 587 |
cpsrvd XSS | CVE-2023-29489 | This impacts cPanel versions prior to 11.109.9999.116, and our servers run a considerably later release: [root@server ~]# cat /usr/local/cpanel/version |
iconv Output Buffer | CVE-2024-2961 | Has been mitigated in CL8 and CL7 [root@server ~]# rpm -q glibc-common-2.17-326.el7_9.3.x86_64 --changelog | grep 2961 |
OpenSSL | CVE-2014-0224 | Mitigated with Update [root@server ~]# rpm -qa --changelog openssl | grep CVE-2014-0224 |
OpenSSL | CVE-2014-0195 | Cloudlinux 8 or newer: Not Affected Source: https://access.redhat.com/security/cve/cve-2014-0195 Cloudlinux7 Fixed: [root@server ~]# rpm -qa --changelog openssl | grep CVE-2014-0195 |
OpenSSL | CVE-2014-0198 | Cloudlinux 8 or newer: Not Affected Source: https://access.redhat.com/security/cve/CVE-2014-0198 Cloudlinux7 server, this has been fixed: [root@server ~]# rpm -qa --changelog openssl | grep CVE-2014-0198 |
OpenSSL | CVE-2014-0221 | Cloudlinux 8 or newer: Not Affected Source: https://access.redhat.com/security/cve/CVE-2014-0221 Cloudlinux7 Fixed: [root@server ~]# rpm -qa --changelog openssl | grep CVE-2014-0221 |
OpenSSL | CVE-2014-3470 | Cloudlinux 8 or newer: Not Affected Source: https://access.redhat.com/security/cve/CVE-2014-3470 Cloudlinux7 Fixed: [root@server ~]# rpm -qa --changelog openssl | grep CVE-2014-3470 |
OpenSSL | CVE-2010-5298 | Cloudlinux 8 or newer: Not Affected Source: https://access.redhat.com/security/cve/CVE-2010-5298 Cloudlinux7 Fixed: [root@server ~]# rpm -qa --changelog openssl | grep CVE-2010-5298 |
OpenSSL | CVE-2014-0076 | Not Affected in Cloudlinux versions 5,6,7 or newer. Source: https://access.redhat.com/security/cve/CVE-2014-0076 |
