How can I downgrade OpenSSL to 1.0.0 in Ubuntu?

Question

I have installed Ubuntu 12.04. Sadly, there is a problem with OpenSSL 1.0.1 and I would need to downgrade to version 1.0.0.

How can I do it the easiest way?

When I run:

sudo apt-cache madison openssl

Only versions 1.0.1 get listed.

All tips are appreciated!

Did you ever try this? Was it sucsessful? Was it because of this bug: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/965371?comments=all — JDS, Feb 20 '13 at 03:20
Yes that was exactly the bug that caused me to downgrade. Due to other reasons we ended up reinstalling the whole OS from scratch (downgraded to earlier Ubuntu). — Jaakko, Feb 20 '13 at 12:41
But, did the downgrade work? It sounds like you never put it into production, though... I was also wondering if there were any ill effects or security problems with doing this — JDS, Feb 20 '13 at 13:12
Yes the downgrade worked. I don't know in detail about the security implications, but if you ask me I'd much rather have a 99% secure service online than 100% secure service offline. — Jaakko, Feb 20 '13 at 16:32

score 2 · Answer 1 · answered May 27 '12 at 17:09

2

apt-get has a feature called Pinning, which addresses your problem. Details can be found in this how-to

answered May 27 '12 at 17:09

Dominic Cronin

670
4
21

This sounds great. I'm reading the docs, but I would really like to hear more help! – Jaakko May 27 '12 at 17:48
What sort of help do you need? Have you already tried creating/editing /etc/apt/preferences and making an entry for openssl? – Dominic Cronin May 28 '12 at 18:00

score 1 · Answer 2 · answered May 27 '12 at 13:52

1

You probably want to download the .deb package. It is the 1.0.0g version of OpenSSL. next you could just install it from the .deb. I have never done a downgrade from OpenSSL myself so you better do not try this on production systems.

answered May 27 '12 at 13:52

timmeyh

968
1
6
25

How can I downgrade OpenSSL to 1.0.0 in Ubuntu?

2 Answers2