[CentOS] security compliance vs. old software versions

What's the correct response to a security scan that points out that 
apache versions below 2.2.14 have multiple known vulnerabilities?  Is 
there an official document about what known vulnerabilities have been 
fixed in the RHEL/CentOS updates or do you have to wade through the 
changelog to try to find each thing?

-- 
   Les Mikesell
    lesmikesell at gmail.com