If your payment processor asks you to pass a PCI compliance network scan, the scan may list "OpenSSH" vulnerabilities on port 22 for the IP address 35.192.183.203. This is the Sociavore server that hosts your website, so the scan checks our server, not something in your account. These results are false positives, and you can ask the scan provider to mark them that way.
Don't change your DNS settings
What the scan shows
The results usually look like this: "OpenSSH Authentication Bypass Vulnerability" or "OpenSSH Multiple Vulnerabilities", with the result "Vulnerable SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.x detected on port 22 over TCP". The suggested fix is to upgrade to OpenSSH 10.3 or later.
Why it's a false positive
Scanners don't test these vulnerabilities. They read the version number the server announces (9.6p1) and compare it with the latest OpenSSH release (10.3). Our server runs Ubuntu 24.04 LTS. Ubuntu keeps the same OpenSSH version number and adds the security fixes to it, so the version number stays "9.6p1" even after the fixes are installed.
All five security issues fixed in OpenSSH 10.3 are fixed in Ubuntu's package 1:9.6p1-3ubuntu13.16, released on 29 April 2026 in Ubuntu Security Notice USN-8222-1. Our server runs a newer package with these fixes.
Security fixes from OpenSSH 10.3 and the Ubuntu 24.04 package that includes them
How to get a passing scan
- In your PCI compliance portal, open the network scan results.
- Next to each OpenSSH result, click Request Exception (some portals call it "Dispute" or "False positive"). If the portal asks for a reason type, choose False positive.
- Copy the text below and paste it as the explanation for each result.
- Submit the request. The scan provider reviews it, which can take a few business days. If your compliance deadline is close, tell your payment processor that an exception request is under review.
False positive: vendor backported security patches (version-only detection)
The finding is based only on the SSH version banner (OpenSSH_9.6p1 Ubuntu-3ubuntu13.x), not on a test of the vulnerabilities. The host 35.192.183.203 is managed by our website provider, Sociavore. It runs Ubuntu 24.04 LTS with the distribution's openssh-server package. Ubuntu keeps OpenSSH at version 9.6p1 and backports security fixes into it, so the upstream version number does not show whether the fixes are installed.
All five vulnerabilities fixed in upstream OpenSSH 10.3 (CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388 and CVE-2026-35414) are fixed in Ubuntu 24.04 package 1:9.6p1-3ubuntu13.16, released 29 April 2026 in Ubuntu Security Notice USN-8222-1. The package on the server is newer than 13.16 and includes these fixes.
Evidence:
- USN-8222-1: https://ubuntu.com/security/notices/USN-8222-1
- Ubuntu CVE tracker (status "Fixed" for 24.04 in 1:9.6p1-3ubuntu13.16): https://ubuntu.com/security/CVE-2026-35385, https://ubuntu.com/security/CVE-2026-35386, https://ubuntu.com/security/CVE-2026-35387, https://ubuntu.com/security/CVE-2026-35388, https://ubuntu.com/security/CVE-2026-35414
- OpenSSH 10.3 release notes: https://www.openssh.org/releasenotes.html
We request that these findings be marked as false positives.If the scan shows something else
If your scan lists results that are not about OpenSSH, or the scan provider asks for more details, message us in the chat or email support@sociavore.co. Please include your website address and a screenshot or copy of the scan report.
Card details at checkout
Guests enter their card details in secure payment fields provided by your payment provider (Square, Stripe or Spreedly). The card details go straight to the provider, and card numbers are not sent to or stored on Sociavore's servers. Please check Payment Options for Online Orders to understand which payment methods guests can use.