We have an Amazon Linux server and we scan it using OpenVAS. It detected one high vulnerability which is Amazon Linux Local Check: alas-2016-754.
Looking at the solution it says Run yum update php70 to update your system.
The vulnerable package detected is:
Vulnerable package: gmp
Installed version: gmp-6.0.0-11.16.amzn1
Fixed version: gmp-7.0.11-1.16.amzn1

At first we don't have php installed. So what we did is install latest version of php. Upon running the suggested solution the result is "No packages marked for update".
We also did yum update.

After doing another scan the package is still detected by OpenVAS. The question is how to update this package?

  • An art of vulnerability scanning is watching out for false positives. Jun 18, 2019 at 8:43

1 Answer 1


This could be caused by the php70-gmp package that is missing. Could you try yum -y install php70-gmp and rerun the OpenVAS scan?

  • I find it weird that you’d have to install more software in this scenario. Or is OpenVAS that broken? Jun 18, 2019 at 8:21
  • @StephenKitt True, but given the specific issue (alas.aws.amazon.com/ALAS-2016-754.html) and the advice given by OpenVAS, it could be a false positive that OpenVAS detects. In AL1, there is only gmp-6.0.0-11.16.amzn1.x86_64 in base. In AL2, there is gmp-6.0.0-15.amzn2.0.2.x86_64. I thought that installing php70-gmp might "resolve" the OpenVAS issue, albeit ugly, and fundamentally incorrect.
    – Edward
    Jun 18, 2019 at 8:25
  • Yeah I’m not saying your answer is wrong, just that it’s rather unfortunate that it is a possible solution. (So it’s not a reflection on your answer, but rather on the state of security auditing tools.) Jun 18, 2019 at 8:42
  • @Edward if the quality of detection by OpenVAS is 97% would it still be considered as false positive?
    – Finn
    Jun 18, 2019 at 9:05
  • 1
    Well that's an academic discussion of course. Every detected vulnerability that's not actually a vulnerability is a false positive, regardless of the percentage true positives. Please see en.wikipedia.org/wiki/Sensitivity_and_specificity for a nice writeup on this. BTW: did the "fix" work?
    – Edward
    Jun 18, 2019 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .