PHP-FPM Security Update HTTPoxy Vulnerability CVE-2016-5385

PHP-FPM Configuration Security Update HTTPoxy Vulnerability CVE-2016-5385

Updated both Centmin Mod 123.08stable and 123.09beta01 builds for HTTPoxy Security Vulnerability CVE-2016-5385 outlined at Mitigating the HTTPoxy Vulnerability with NGINX To fix on existing Centmin Mod systems, update latest 123.09beta01 or 123.08stable branch code via centmin.sh menu option 23 and then exit centmin.sh and re-run centmin.sh one more time. Full detail and example of update at Beta Branch - security fix for php-fpm for http proxy header CVE-2016-5385 | Centmin Mod Community

To update your Centmin Mod builds follow instructions at centminmod.com/upgrade.html and respective version threads below:

• Centmin Mod 1.2.3-eva2000.08 stable install & update thread
• Centmin Mod 123.09beta thread
• Example of centmin.sh menu option 23 git updating code.
• How to upgrade Centmin Mod + backing up customisations

Actual commits

• Beta Branch - security fix for php-fpm for http proxy header CVE-2016-5385 | Centmin Mod Community
• Beta Branch - ensure fixphpfpm_httpproxy restarts php-fpm | Centmin Mod Community

 

Dedicated discussion thread at PHP - Discuss HTTPoxy Security Vulnerability CVE-2016-5385 | Centmin Mod Community

 

If you don't use centmin.sh menu option 23 submenu option 2 to update your centmin mod code, you can just use git command line if you already have Centmin Mod git environment setup via centmin.sh menu option 23 submenu option 1. Using these commands in SSH session are equivalent to using centmin.sh menu option 23 submenu option 2

Code (Text):

cd /usr/local/src/centminmod
git stash
git pull
./centmin.sh