Your scanning vendor should know better and advise you properly. Just kidding, the "security" industry sucks. Debian and other long term enterprise distributi

Your scanning vendor should know better and advise you properly. Just kidding, the "security" industry sucks. Debian and other long term enterprise distributions backport fixes for these unacceptable security holes. A better solution is to simply turn off the minor version string as that's the extent of their testing. I'd guess a good number of people intuitively do what you did. The problem is, instead of getting sucked in by a scheduled apt-get update, now you probably wont notice critical fixes until the next quarterly scan is due.