• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Question HTTPoxy vulnerability: CVE-2016-5387

Faris Raouf

Silver Pleskian
Plesk Guru
Does this affect the Admin CP side of Plesk 10.4.4 ?

Has anyone come up with a solution?

Yes, I know 10.4.4 is EOL. But it is till used widely, and it would be nice to know if it is affected and how to resolve it if it is.
 
KB129391 deals with the customer-side (hosting) php/nginx/apache.

What I am concerned about is the Plesk admin panel php and webserver, specifically for 10.4.4 as it is EOL.

I'm pretty sure even Plesk 10 uses its own php, and its own webserver (nginx?), which are not provided by the vendor.

I realise that in order to be exploited, the vulnerability requires the running application to be coded in a certain way and to do certain things.
If Plesk is not coded in such a way then there is no problem. But I do not know one way or another.
 
Hi Faris Raouf,

What I am concerned about is the Plesk admin panel php and webserver, specifically for 10.4.4 as it is EOL.

I'm not sure, if I remember it right, but isn't there as well the file "/etc/sw-cp-server/fastcgi.conf", where you could as well add as suggested:
3. For Plesk panel:

~# sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

# Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";

EOF
 
I had looked into that, and there is no fastcgi.conf or similar anywhere in Plesk 10.4.4.

A bell at the back of my head is saying "litespeed" not nginx for Plesk in 10.4.4, but that might be wrong.
 
Hello,

Can anybody tell me how to do this?

3. For Plesk panel:

~# sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

# Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";

EOF

I type:

sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

Then:

>

Have I to paste # Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";

EOF
?
And then how I close it?

Thanks a lot
 
Thanks IgorG, as fast as always.

So I have to do that in all the servers with plesk under 12.0, isn´t it? 12.0 and up are fixed by MU.
 
So I have to do that in all the servers with plesk under 12.0, isn´t it? 12.0 and up are fixed by MU.
Install all latest microupdates on your Plesk server and check output of

# grep 'fastcgi_param HTTP_PROXY' /etc/sw-cp-server/fastcgi.conf

if there is no record

fastcgi_param HTTP_PROXY "";

you need to add it manually.
 
Back
Top