14

On Ubuntu 18.04.5 LTS (server) with LAMP stack I got a prompt to confirm package degradation:

The following packages will be DOWNGRADED:
  libssl1.1 openssl

This two packages are:

dpkg --list "libssl*"
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                           Version              Architecture         Description
+++-==============================-====================-====================-==================================================================
ii  libssl1.0.0:amd64              1.0.2n-1ubuntu5.6    amd64                Secure Sockets Layer toolkit - shared libraries
ii  libssl1.1:amd64                1.1.1j-1+ubuntu18.04 amd64                Secure Sockets Layer toolkit - shared libraries


dpkg --list "openssl*"
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                           Version              Architecture         Description
+++-==============================-====================-====================-==================================================================
ii  openssl                        1.1.1j-1+ubuntu18.04 amd64                Secure Sockets Layer toolkit - cryptographic utility
un  openssl-blacklist              <none>               <none>               (no description available)

It seems like I cannot proceed with regular apt-get upgrade and not to choose to downgrade this pkgs.

My question is: is there a way to configure apt not to enforce this degradation / how?

Special thanks to answer that will clarify if this degradation is perhaps a sane decision (I doubt that, but still) and how to find which component might be responsible for this.

EDIT: apt policy per pkgs output:

apt policy libssl1.1 openssl
libssl1.1:
  Installed: 1.1.1j-1+ubuntu18.04.1+deb.sury.org+3
  Candidate: 1.1.1-1ubuntu2.1~18.04.8
  Version table:
 *** 1.1.1j-1+ubuntu18.04.1+deb.sury.org+3 100
        100 /var/lib/dpkg/status
     1.1.1-1ubuntu2.1~18.04.8 1000
        500 http://rs.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://rs.archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
     1.1.0g-2ubuntu4 1000
        500 http://rs.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
openssl:
  Installed: 1.1.1j-1+ubuntu18.04.1+deb.sury.org+3
  Candidate: 1.1.1-1ubuntu2.1~18.04.8
  Version table:
 *** 1.1.1j-1+ubuntu18.04.1+deb.sury.org+3 100
        100 /var/lib/dpkg/status
     1.1.1-1ubuntu2.1~18.04.8 1000
        500 http://rs.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://rs.archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
     1.1.0g-2ubuntu4 1000
        500 http://rs.archive.ubuntu.com/ubuntu bionic/main amd64 Packages

3 Answers 3

11

You installed openssl from another source than the Ubuntu 18.04 repositories(?) or have held back openssl and your installed version does not include an important security patch. The 18.04 version then gets priority over your version regardless of the version number.

Please add to the question results of

apt policy libssl1.1 openssl

That will show more information about the packages. Including where it came from :)

Accept the package downgrade. It will install improved version over the one you use now.

3
  • Thanks. I've updated the Q. Mar 17, 2021 at 9:53
  • I upvoted too fast for my old sql server. In fact It works but it had to not to be done blindly with old SQL Server. It launchs: "Microsoft ODBC Driver 17 for SQL Server : SSL Provider ssl_choose_client_version:unsupported protocol". I don't know yet if only the modification of openssl.cnf (MinProtocol = TLSv1.0 and CipherString=DEFAULT@SECLEVEL=1) is enough to fix or if the version of the lib has to be modified too.
    – phili_b
    Jun 4, 2021 at 16:00
  • I've changed the lib too and It works now: wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1-1ubuntu2.1~18.04.9_amd64.deb and sudo dpkg -i libssl1.1_1.1.1-1ubuntu2.1~18.04.9_amd64.deb .
    – phili_b
    Jun 4, 2021 at 18:08
10

From https://www.patreon.com/posts/enforced-openssl-48703169:

custom src:openssl packages were introduced to upgrade the cryptographic functions for PHP, Apache2 and NGINX, but the situation have improved greatly since.

With Ubuntu 16.04 LTS reaching end-of-life in about 2 weeks (April 2021), the openssl packages can now be "downgraded" to the version provided by the distribution. Run apt upgrade --allow-downgrades to proceed.

1
  • 6
    To make it clearer; if you're using Ondřej Surý's PHP/Apache/Nginx or other packages (it's probably the most common apt install target for PHP) then the linked post explains the openssl downgrade. If you're not using those packages, it's caused by something else.
    – M1ke
    Mar 22, 2021 at 9:23
4

I thought I'd expand on @M1ke's comment on Roger Dueck's response: This message is typical if you've got your system configured to use additional repositories which may include OpenSSL + related packages; these may not be as up-to-date as they should be despite superficially higher version numbers in their package identifiers.

The link Roger posted gives a bit more detail; from there: "The custom src:openssl packages were introduced to upgrade the cryptographic functions for PHP, Apache2 and NGINX". Note that that article is written by Ondřej Surý, the very person who provides the additional repositories used by many Ubuntu users for PHP / Apache / nginx. Ondřej points to a page where he provides more detail (esp. if that's the repository you're using).

Personally I tend to use apt-get upgrade --dry-run before any upgrade; this is helpful to show you what's going on (apt policy as suggested by @Rinzwind does the same in more detail): Here's the output from one system prior to the requested 'downgrade',

# apt-get upgrade --dry-run
[...snip...]
The following packages will be DOWNGRADED:
  libssl-dev libssl1.1 openssl
0 upgraded, 0 newly installed, 3 downgraded, 0 to remove and 12 not upgraded.
Inst libssl-dev [1.1.1i-1+ubuntu18.04.1+deb.sury.org+4] (1.1.1-1ubuntu2.1~18.04.9 Ubuntu:18.04/bionic-updates, Ubuntu:18.04/bionic-security [amd64]) []
Inst libssl1.1 [1.1.1i-1+ubuntu18.04.1+deb.sury.org+4] (1.1.1-1ubuntu2.1~18.04.9 Ubuntu:18.04/bionic-updates, Ubuntu:18.04/bionic-security [amd64])
Inst openssl [1.1.1i-1+ubuntu18.04.1+deb.sury.org+4] (1.1.1-1ubuntu2.1~18.04.9 Ubuntu:18.04/bionic-updates, Ubuntu:18.04/bionic-security [amd64])
[...snip...]

in particular note the currently-installed package name: 1.1.1i-1+ubuntu18.04.1+deb.sury.org+4 which helpfully includes deb.sury.org to indicate where it's likely to have come from (in this case Ondřej Surý's repo as mentioned above), and the replacement package name 1.1.1-1ubuntu2.1~18.04.9 and repo (main Ubuntu repos).

Once I'm comfortable with the changes proposed I re-run the apt-get upgrade without the --dry-run flag to actually do the upgrade.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.