Zabbix Apache version

[tombaz47]

I am running Zabbix on CentOs Stream8 and our internal vulnerability scanner has picked up a vulnerability in Apache version 2.4.37.

It advises to update Apache to 2.4.62 to resolve this.

Is this possible to do for Zabbix on the current OS I have it installed on? If not, is there another way to resolve?

[kamil1]

Apache is rather the package of CentOs. The version 8 seems to be already end of life: https://blog.centos.org/2023/04/end-...entos-linux-7/

[MRedbourne]

I wouldn't worry about the apache version specifically. Zabbix supports apache from version 2.4.0+ (released 2012) for ZBX 6.0 or newer. Apache 1.3.12 or later for ZBX 5.0 LTS. You do need to be worried about your php version.

2 Requirements (zabbix.com)

CentOS 8 is dead - it's advisable to "leapp" upgrade from EL8 to EL9 (EL = Enterprise Linux... in your case, CentOS). Leapp will handle checks to ensure packages are compatible and whatnot. Lots of guides online using LEAPP tools - but it's relatively straight forward. We multi-jumped some of our servers across multiple versions (with the deprecation of EL7). C7 -> R7 -> R8 (Temporary) -> R9.0 -> R9.4 because the underlying server (not Zabbix) was critical to us, far enough away that we didn't want to leave it unpatched. We also have standby licenses available in case something pops up requiring a spare RHEL license.

I'd also advise going Red Hat for a prod server even with self-support. CentOS is a released ahead of the traditionally stable RHEL. If you don't want to pay, CentOS is probably fine still, or you can sort out a new distro within the linux community.