This always pops up when we have audits performed; Solutionary in particular seems to just go by version number with ssh, and doesn't seem to recognize that RHEL has backported numerous fixes into it's RPMs.