• Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
    To get into the festive spirit, install the Skins extension.
  • The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

HOW TO: Update OpenSSL for Plesk Control panel

T

thijshoutenbos

Guest
The version of OpenSSL used by the Plesk Control Panel (Apache) contains a vulnerability that may allow an attackers to cause a DoS attack, or even worse: possibly gain a remote shell.

This vulnerability was present in the most recently update Plesk 7.6, and was confirmed by scanning the host with the online security audit tool Hackerguardian.

To update to the latest version you need to download the latest OpenSSL from Sourceforge:
http://sourceforge.net/project/downloading.php?groupname=gnuwin32&filename=openssl-0.9.7c-bin.zip

You need to replace the files 'libssl32.dll' and 'libeay32.dll' in the folder 'C:\Program Files\SWsoft\Plesk\admin\bin' (or any other location you installed Plesk). Be sure to back up the DLLs you replace before overwriting them. After restarting your Plesk Control Panel service you now use the updated OpenSSL library and should no longer be vulnerable to this attack (this was also verified by re-scanning the server with Hackerguardian).

Perhaps this fix will be included in an official patch from SWsoft later, but for now I thought it was wise to share this little HOWTO with you.
 
After this I had a problem:

Code: 
The service did not respond to the start of control request in a timely fashion. (Error code 1053) at StartService 'PLESKMISCRV'

The Plesk Miscellaneous Service didn't start.
 
Hmmm... strange that the Plesk Control Panel would work fine with this update, but the Plesk Miscellaneous Service does not work...

Well, it's a good thing the replaced DLLs are backed up. You can just copy those backups back to restore the previous version and the problem is gone...

I hope SWsoft will add the latest version of OpenSSL to their automated updates soon and plug this problem.
 
Originally posted by thijshoutenbos

Well, it's a good thing the replaced DLLs are backed up. You can just copy those backups back to restore the previous version and the problem is gone...
Click to expand...

It's what I've done :)
Otherwise new openSSL included also an openssl.exe, probably is the old one that generate this issue.
 
You must log in or register to reply here.

Similar threads

macadia
Resolved Securing the Plesk control panel with two access URLs
Replies
2
Views
284
macadia
macadia
J
Resolved Problem for update Plesk Obsidian
Replies
4
Views
483
JM Malsacre
J
TorbHo
Issue PHP TuxCare System Updates: ALT-PHP packages held back due to PHP-FPM dependency conflicts
Replies
4
Views
1K
mow
M
Hangover2
Critical security issue fixed on 24–25 February 2026 (Plesk Obsidian 18.0.75 Update 1 / 18.0.76 Update 2) — request for vulnerability details
Replies
4
Views
10K
Hangover2
Hangover2
R
Resolved CVE-2026-42945 Nginx Rift and older Wordpress Toolkit heads up
Replies
14
Views
13K
rhall
R
Back
Top