I have a fully patched CentOS 5.5 server that is failing the Trustwave PCI compliance scan. The items it is complaining about is openssl < 0.9.8.o.  

rpm -q openssl shows:
openssl-0.9.8e-12.el5\_5.7

The apache header banner shows:
Server: Apache/1.3.41 (Unix) PHP/5.2.14 mod\_psoft\_traffic/0.2 mod\_ssl/2.8.31 OpenSSL/0.9.8b mod\_macro/1.1.2

(note: that apache banner is not even showing the the installed version)

openssh and php have a similar situation (reported version is less than the minimum for PCI compliance). 

Do I need to build all these libraries from source to get them on the latest version? Or is there a way to tell CentOS yum to install the new version instead of their back-ported patched version? I'd rather not go outside yum if possible so future maintenance will be simplified