Why Vulnerability Scans May Flag Apache on Ubuntu LTS (False Positives Explained)

How Ubuntu Handles Security Updates

Each Ubuntu LTS release ships with a specific version of Apache and keeps that version for the entire support life of the release. For example, Ubuntu 24.04 LTS ships Apache 2.4.58 and will continue to report version 2.4.58 for its full support lifecycle — it will never report 2.4.67 or 2.4.68, no matter how many security patches have been applied.

Instead of upgrading to newer upstream versions (which would introduce new features and potential compatibility risks), Canonical (the maker of Ubuntu) backports the individual security fixes from newer Apache releases into the version Ubuntu ships. This approach:

• Delivers the same security fixes found in newer Apache releases

• Avoids introducing new features or behavior changes that could break applications

• Keeps servers stable and predictable while remaining fully patched

This is standard practice for enterprise Linux distributions and is documented by Canonical here: Security updates – Ubuntu security documentation

Reading the Version Number Correctly

The main Apache version number does not change with security updates. What changes is the package revision — the part of the version string after the dash:

2.4.58-1ubuntu8.15
└──┬──┘ └────┬────┘
upstream    Ubuntu package revision — increments with each
base        security update; this is the meaningful number

• 2.4.58 — the upstream Apache base version. This stays the same for the life of the Ubuntu release.

• 1ubuntu8.15 — the Ubuntu patch level. This increments every time Canonical publishes a security update, and this is the number that reflects the server's actual patch state.

You can see the full package version with:

$ dpkg -l apache2
||/ Name           Version            Architecture Description
+++-==============-==================-============-=========================
ii  apache2        2.4.58-1ubuntu8.15 amd64        Apache HTTP Server

Why Scanners Report False Positives

Most vulnerability scanners (Nessus, Qualys, OpenVAS, etc.) running uncredentialed / banner-based scans only see the version string Apache reports in its HTTP headers — for example, Apache/2.4.58 (Ubuntu). The scanner compares that number against the latest upstream Apache release and concludes the server is behind.

The scanner has no visibility into the Ubuntu patch level or the backported fixes inside the binary. Many scan reports even acknowledge this directly with a note such as: "the scanner has not tested for these issues but has instead relied only on the application's self-reported version number."

In other words, the scanner is checking the label, not the contents.

How to Verify a Server Is Actually Patched

1. Check the full package version on the server: dpkg -l apache2

2. Look up the CVE on Ubuntu's security tracker. Every CVE has a page showing which package revision fixed it for each Ubuntu release: https://ubuntu.com/security/CVE-XXXX-XXXXX

3. Review Ubuntu Security Notices (USNs). Each security update is published as a USN listing the CVEs fixed and the exact package version that contains the fix: https://ubuntu.com/security/notices

4. Inspect the package changelog on the server, which lists each applied CVE patch by name: apt changelog apache2

Worked Example

A scan flags a server for "Apache 2.4.x < 2.4.68 Multiple Vulnerabilities." The server is running Ubuntu 24.04 LTS with package version 2.4.58-1ubuntu8.15.

Checking Ubuntu's security notices shows the CVEs from that finding were fixed in the following package revisions for Ubuntu 24.04:

Since the installed version (8.15) includes all of these updates, every CVE in the finding is already remediated. The scan result is a false positive.

What We Recommend for Your Security Team

• Run credentialed (authenticated) scans where possible. When the scanner can log in and read the installed package versions, it correctly recognizes Ubuntu's backported fixes and these false positives disappear.

• Mark banner-based Apache/Ubuntu findings as false positives once patch status is verified, or configure the scanner to recognize the distribution's patch levels (most major scanners support this).

• Request verification evidence from us if needed — we can provide the dpkg output, changelog entries, and the matching USN references for any flagged CVE.

Frequently Asked Questions

Why not just install the newest Apache version from a third-party repository?
Third-party packages fall outside Ubuntu's security update process, meaning the server would no longer receive Canonical's automatic security patches and would depend on the third party for timely fixes. Using the standard Ubuntu packages is the more secure and more maintainable approach — the server stays current with official security updates for the entire life of the OS release.

Does the "older" version number mean we're missing features?
The backported updates include security fixes only, not new features. If a specific new Apache feature is required, that is a separate discussion — but security-wise, the Ubuntu package is fully patched.

How long will Ubuntu keep patching this version?
Ubuntu LTS releases receive security updates for 5 years standard, extendable to 10+ years with Ubuntu Pro/ESM. Apache 2.4.58 on Ubuntu 24.04 will continue receiving backported security fixes throughout that window.

References

• Security updates – Ubuntu security documentation

• Ubuntu Security Notices

• Ubuntu CVE Tracker