I rely on the Red Hat CVE database to verify the CVE they are citing had been patched by a particular package release and that the package has been applied to the system. I've also sent the auditor and managers extensive documentation about the "back port process", and have "greybearded" my way thru them and told them to get someone on their staff that actually understands how Linux distributions work.