Question How to update Apache installed on CentOS 7.3

[Zoo3]

Currently my server uses Plesk 17.0.3 and Apache 2.4.6 is installed. I would like to update this Apache to 2.4.26.

I referred to the site below, but it did not work.
How to Install Plesk in a Linux CentOS server - Pickaweb

First I will remove it in order.

1. yum remove http*
2. yum remove php*
3. yum remove cyrus*
4. yum remove mysql*

I can't remove this Cyrus. I am required to remove Systemd and YUM.
next, Ignoring this, MySQL will not remove anything.

next, Then proceed with installing Plesk.
wget -O - http://autoinstall.plesk.com/one-click-installer | sh

In this installation process, "IPv4 (or IPv6)" pull down menu can not be specified with blank.

Please tell me how to update to Apache 2.4.26 on the server containing Plesk Onyx.

My emvironment:
CentOS 7.3 Apache 2.4.6 Plesk Onyx 17.0.3 PHP7.1 (php 5.4.16?)

 

[IgorG]

Please tell me how to update to Apache 2.4.26 on the server containing Plesk Onyx.

It is really not a trivial task - #3

 

[AYamshanov]

Hi Zoo3,

Did you see Resolved - Apache upgrade to latest version ? Also, could you explain why do you want update Apache to 2.4.26?

 

[Zoo3]

Hi Zoo3,

Did you see Resolved - Apache upgrade to latest version ? Also, could you explain why do you want update Apache to 2.4.26?

I have not updated yet. Because I don't understand Systemd or YUM, I can't easily stop or delete it. I proceeded the process partway, but then recovered CentOS.

I am vulnerable about Apache httpd reported. Apache 2.4.25 and earlier versions have vulnerability issues.
CVE-2017-3167, CVE-2017-3169, CVE-2017-7659, CVE-2017-7668, CVE-2017-7679

 

[IgorG]

CVE-2017-3169

Plesk ships mod_ssl for Plesk 12.5, 12.0 for CentOS 5, CloudLinux 5.
But CentOS 5 and CloudLinux 5 are EOLed. So, Plesk products are not affected.

CVE-2017-7659

Plesk does not ship mod_http2

CVE-2017-7679

Plesk does not ship mod_mime.

CVE-2017-3167

CVE-2017-7668

Plesk does not ship httpd. I think you can clarify with CentOS, whether their httpd package in the official repository is protected by the corresponding security patches? The same for mod_http2 and mod_mime.