openssh unix dev - Apr 2016 - Issue upgrading openssh from 6.6p1 to 7.2p2

Hi Guys

I have a server running with Ubuntu 14.04, but i have an issue with PCI
requeriments. I have installed in my server openSSH 6.6p1, then i upgraded
it to openSSH 7.2p, compiling code with*make and make install directly from
repositories from openSSH*, but it seems something is broken because i
continue getting the old version after i check dpkg -l openssh*

ii openssh-client 1:6.6p1-2ubunt amd64 secure shell (SSH) client,
ii openssh-server 1:6.6p1-2ubunt amd64 secure shell (SSH) server,
ii openssh-sftp-serve 1:6.6p1-2ubunt amd64 secure shell (SSH) sftp server

And PCI scanner continues reporting same issue about that i have to install
the latest version of openSSH.

but i i try *ssh -V* i get the right version of openssh << 7.2p2 >>

This is the CVI Id of the issue: CVE-2016-3115

thanks

On Wed, Apr 06, 2016 at 10:16:27AM -0500, rigoberto giraldo
wrote:
> I have a server running with Ubuntu 14.04, but i have an issue with PCI
> requeriments. I have installed in my server openSSH 6.6p1, then i upgraded
> it to openSSH 7.2p, compiling code with*make and make install directly from
> repositories from openSSH*, but it seems something is broken because i
> continue getting the old version after i check dpkg -l openssh*
> 
> ii openssh-client 1:6.6p1-2ubunt amd64 secure shell (SSH) client,
> ii openssh-server 1:6.6p1-2ubunt amd64 secure shell (SSH) server,
> ii openssh-sftp-serve 1:6.6p1-2ubunt amd64 secure shell (SSH) sftp server
dpkg tells you what's been installed from packages.  If you're using
"make" and "make install", then you've stepped outside
the packaging
system and will have to take responsibility for it yourself.

You might be better off backporting the packages from Ubuntu 16.04
instead.
> And PCI scanner continues reporting same issue about that i have to install
> the latest version of openSSH.
You probably didn't install it in such a way that the new sshd will in
fact be running.

-- 
Colin Watson                                       [cjwatson at debian.org]