In general, you should use the latest version for the stable Debian version you're running. That version will have all the security fixes applied, and in this case, CVE-2018-15473 is fixed by the upgrade to the latest version in stretch and buster.
Security vulnerability scanners often flag false positives because most Linux distros backport security fixes to the latest stable version instead of updating the package to the latest version. Often the latest version can have breaking changes or incompatible behavior, and users would not appreciate an automatic update to their stable version breaking things.
Most of the time, these versions don't contain a distinguishing version number that's exposed to external systems. Reporting version numbers is generally frowned upon from a security perspective, because it leaks information. So if the security audit reports an issue, you should ask what vulnerabilities they've identified, and be prepared to show that you're running a patched version that addresses them. The companies that run these security audits tell you to upgrade because that's the easiest thing and finding problems with secure but older software makes people think their services are valuable, but major companies just use the patched distro packages in practice.