Resolved SSL issue CVE-2016-2107

[stefanoostwegel]

Dear all,

I have found out my server is vulnarable for SSL issue CVE-2016-2107.
This should be resolved in plesk 12.5.30 #37 on Centos5

I am running plesk 12.5.30 #42 on centos5 but SSLLABS shows me that this issue is still present.
There is no article on how to solve this issue, as it had been resolved in #37.
Any suggestiong how to fix this?

thank you

 

[AndreyZ]

Hello,

Could you give the output of the following commands to find out a cause of the problem?

rpm -qf `which nginx`
nginx -V
rpm -qf /usr/lib64/httpd/modules/mod_ssl.so
strings /usr/lib64/httpd/modules/mod_ssl.so | grep 'OpenSSL [0-9]' --max-count=1

 

[stefanoostwegel]

[****@************* ~]# rpm -qf `which nginx`
sw-nginx-1.11.1-centos6.16080113.x86_64
[****@************* ~]# nginx -V
nginx version: nginx/1.11.1
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/usr/share --sbin-path=/usr/sbin/nginx --conf-path =/etc/nginx/nginx.conf --modules-path=/usr/share/nginx/modules --error-log-path= /var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --lock-path=/ var/lock/nginx.lock --pid-path=/var/run/nginx.pid --http-client-body-temp-path=/ var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy- temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http- uwsgi-temp-path=/var/lib/nginx/uwsgi --user=nginx --group=nginx --with-ipv6 --wi th-file-aio --with-http_v2_module --with-http_ssl_module --with-http_realip_modu le --with-http_sub_module --with-http_dav_module --with-http_gzip_static_module --with-http_stub_status_module --add-dynamic-module=/usr/share/passenger/ngx_htt p_passenger_module
[****@************* ~]# rpm -qf /usr/lib64/httpd/modules/mod_ssl.so
mod_ssl-2.2.15-54.el6.centos.x86_64
[****@************* ~]# strings /usr/lib64/httpd/modules/mod_ssl.so | grep 'OpenSSL [0-9]' --max-count=1

 

[stefanoostwegel]

Thank you for your fast answer, i hope you can help me out with this

 

[stefanoostwegel]

Hmm seem slike my service provider upgraded Centos to 6. Could this be part of the Plesk updates?

 

[stefanoostwegel]

It seemed to be the Centos6 issues, updating openSSL was the fix.
Thank you alot for your fast respons