The PCI requirement is to:
ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.
Just randomly downloading unsupported alternative software versions is not what you should be doing...
The Vendor Response is:
The Red Hat Security Response Team has rated this issue as having Low security impact, a future update may address this flaw.
So no Red Hat fix for now and therefore no CentOS fix either.
The reason for that Low Risk assessment is because the default configuration that is shipped by Red Hat and CentOS does not include wildcard (*) AcceptEnv values.
Now the question is, are you vulnerable because you changed the vendor supplied defaults? If so, can you remove/rewrite your custom AcceptEnv wildcards making your system secure again?
Or is the auditor just triggered by the openssh software version number are you not really vulnerable at all?
Because the latter happens all the time...