SH 4.0 vulnerabilities

I was forced to upgrade from SH 2.4.2 to SH 4.0 because fixes for the 
Linux slapper vulnerability were not available from RedHat for the 
older version of Stronghold.

So after spending my $1000 to get the latest version, what do I get? 
The CD I receive has version  Stronghold 4.0 that has the Apache HTTP 
server chunked encoding heap buffer overflow as well as the Openssl 
SSL2 master key buffer overflow.

What  a disappointment.  It doesn't say much for RedHat.  When you 
purchase a product, you should at expect that all the old, known 
vulnerabilities should be removed.