This message was deleted.

according to the header its apache Server: Apache

Thanks, yes I did a bit of research, I should had before ... and it is Apache indeed!

which CVE got it flagged?

A good few but the only relavant one based on the Apache version, 2.4.43 for 12.1-60.19 is CVE-2020-11984. I was going to check if latest firmware got Apache upgraded.

You can always write a mail to security@citrix.com with security related questions

Good idea, I'll do that, thanks!

I can't see that module is enabled on the ADC, it should be this module from what i can get from the CVE https://httpd.apache.org/docs/2.4/mod/mod_proxy_uwsgi.html i would assume a false positive. You can in a shell type apachectl -M to list apache modules. Loaded Modules: core_module (static) authn_file_module (static) authn_core_module (static) authz_host_module (static) authz_groupfile_module (static) authz_user_module (static) authz_core_module (static) access_compat_module (static) so_module (static) reqtimeout_module (static) filter_module (static) http_module (static) mime_module (static) log_config_module (static) env_module (static) headers_module (static) setenvif_module (static) version_module (static) mpm_prefork_module (static) unixd_module (static) dir_module (static) alias_module (static) rewrite_module (static) php7_module (shared) perl_module (shared) auth_pam_module (shared) authnz_external_module (shared) gsoap_module (shared) proxy_module (shared) proxy_wstunnel_module (shared)

Super, thanks a mill Mads, I double checked and have the same result, the module is not loaded, it's another false positive and it was the last, all good 👍