Issue Nginx version bundled with Plesk is out-dated

[prprtl]

The Nginx version that is bundled with Plesk is the very out-dated 1.11.1 (31 May 2016) and needs updating for fixes for vulnerability CVE-2017-7529 and a long list of bugs. See https://talk.plesk.com/forums/plesk-suggestions-and-feedback.676/create-thread

Recommended is updating to the latest stable (LTS) release: 1.12.2 (17 Oct 2017)

 

[IgorG]

# plesk version
Product version: Plesk Onyx 17.8.11 Update #6
Update date: 2018/04/13 02:59
Build date: 2018/04/12 20:10
OS version: CentOS 7.2.1511

# nginx -V
nginx version: nginx/1.13.8

 

[prprtl]

Plesk 12.5 is still using an older version.

# plesk version
Product version: 12.5.30 Update #75
Update date: 2018/04/17 23:42
Build date: 2016/06/08 10:00
OS version: CentOS 7.4.1708
Revision: 344620
Architecture: 64-bit
Wrapper version: 1.2

# nginx -V
nginx version: nginx/1.11.1
built with OpenSSL 1.0.2k 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/share --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --modules-path=/usr/share/nginx/modules --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --lock-path=/var/lock/nginx.lock --pid-path=/var/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --user=nginx --group=nginx --with-ipv6 --with-file-aio --with-http_v2_module --with-http_ssl_module --with-http_realip_module --with-http_sub_module --with-http_dav_module --with-http_gzip_static_module --with-http_stub_status_module --with-openssl=/home/builder/buildbot/nginx-1.11.1-bcos7x64/build/nginx/work/openssl-1.0.2k --with-openssl-opt='enable-tlsext zlib no-idea no-mdc2 no-rc5 no-ssl2 no-shared -fpic' --add-dynamic-module=/usr/share/passenger/ngx_http_passenger_module​

Why not use the LTS version?

 

[IgorG]

Plesk 12.5 is still using an older version.

Look at Plesk lifecycle - https://www.plesk.com/lifecycle-policy/
As you can see Extended Support will start on June 16, 2018 for Plesk 12.5.
I think that you understand that we will not release any serious component updates for this outdated Plesk version.
So, please consider upgrade possibility or try to adapt and use this script - Archive - Script for building replacement of default sw-nginx Plesk package (CentOS7 Only!)

 

[prprtl]

That is an unexpected answer. Plesk 12.5 is still supported. This is a security vulnerability.

 

[IgorG]

This is a security vulnerability.

Could you be more specific here?

 

[prprtl]

As stated in the original post. The bundled version of Nginx 1.11.1 with Plesk 12.5 contains known serious bugs and vulnerability CVE-2017-7529. You should update the bundled version to a supported version.

You suggested that Plesk 12.5 is not supported anymore. That is false. Plesk 12.5 is still under active support according to https://www.plesk.com/lifecycle-policy/.

 

[IgorG]

You suggested that Plesk 12.5 is not supported anymore

You are wrong:

As you can see Extended Support will start on June 16, 2018 for Plesk 12.5.

Do you feel the difference?

 

[prprtl]

You stated that Plesk 12.5 was out-dated and that I should expect no updates. You also directed me to a hacky script to compile bleeding edge versions of software. I hope you can see why I am disappointed with your replies.

As stated very simply, Plesk 12.5 distributes a two year old insecure version of Nginx and should update it according to the support policy. Unfortunately we have to rely on Plesk for Nginx updates on Plesk systems, because the Nginx installation is bundled with Plesk.

 

[IgorG]

@prprtl I forwarded this issue to responsible persons and will update this thread with results.
But anyway, I strongly recommend you upgrade to latest Plesk version.

 

[prprtl]

Thank you for triaging this issue. Awaiting your follow-up.

 

[IgorG]

Awaiting your follow-up.

We are going to update nginx for Plesk 12.5 before June 16, before starting the Extended Support.