Move off end-of-life software on nginx

Why it matters

The software versions named in the finding no longer get security fixes from their vendor or from any long-term distribution, so every hole found from now on stays open. Moving to a supported release is the only fix; hiding the version number does not help.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find out where nginx comes from. If it is your distribution's package, upgrade the operating system to a supported release, which brings a maintained nginx. If it comes from nginx.org's repository, update to the current stable or mainline release.
2. Test the configuration with nginx -t on the new system, switch over, and rescan.
3. Set server_tokens off afterwards so the exact version is not shown. That is good practice but not a fix.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cms and framework advisories check
• Keep the software named in the finding up to date
• Update the CMS or application to a patched release
• Patch the exploited vulnerability in your CMS or application
• Update WordPress to the current release