[Pkg-openssl-devel] Downgrade of libssl1.1

[Benjamin Kuhl]

Hey,


i have a question. Today i made an update on my debian 10 system and i 
recieved a message during the update. I feel now a bit insecure about 
the message.

I added the repository from Ondřej Surý deb.sury.org to my system, 
because i needed the php7.4 packages for some services i run.

And he made changes to my system, that when i run apt dist-upgrade, then 
the libssl1.1 version will be downgraded to libssl1.0. He sad that 
libssl1.1 reaches end of life and libssl1.0 has long term service.


Now im asking me, why did not the official repository made these 
changes? And isnt there a newer package when libssl1.1 reaches end of 
life? I saw a package like libssl3 somewhere.


Im not sure at the moment if i want to downgrade, because a while ago i 
read about many ssl problems and i dont know if the libssl1.0 was fixed.

Here a link to show what i mean

https://github.com/oerdnj/deb.sury.org/issues/1563