4

I'm facing the following problem. If I run the command sudo apt-get upgrade, I get:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages have been kept back:
  libssl1.0.0:i386
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

and if I run sudo apt-get install libssl1.0.0:i386

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 apache2-mpm-prefork : Depends: apache2.2-bin (= 2.2.22-13+deb7u1) but it is not going to be installed
 apache2.2-common : Depends: apache2.2-bin (= 2.2.22-13+deb7u1) but it is not going to be installed
                Depends: apache2-utils but it is not going to be installed
                Recommends: ssl-cert but it is not going to be installed
 libssl1.0.0 : Breaks: libssl1.0.0:i386 (!= 1.0.1e-2+deb7u6) but 1.0.1e 2+deb7u7 is to be installed
 libssl1.0.0:i386 : Breaks: libssl1.0.0 (!= 1.0.1e-2+deb7u7) but 1.0.1e-2+deb7u6 is to be installed
E: Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.

I'm using Debian 7 64.

Could you please explain what's really going on? Is there somethign wrong in my server?

Thank you.

2

The issue seems to be that you can't have both the amd64 and i386 versions of libssl1.0.0 installed together unless they are exactly the same version. Above the amd64 version is 1.0.1e-2+deb7u6 while the i386 version is 1.0.1e-2+deb7u7.

For some reason the i386 architecture has a newer version of the package than the others, it is unclear why this is. Perhaps it is just taking its time to propagate through the servers. The package does seem to be an important security update, I have copied the changes below:

openssl (1.0.1e-2+deb7u7) wheezy-security; urgency=high

  • Non-maintainer upload by the Security Team.
    • Fix CVE-2010-5298: use-after-free race condition.
    • Add a versioned dependency from openssl to libssl1.0.0 to a version that has the fix for CVE-2014-0160 (Closes: #744194).
    • Propose restarting prosody on upgrade (Closes: #744871).
    • Correctly detect apache2 installations and propose it to be restarted (Closes: #744141).
    • Add more services to be checked for restart.
    • Fix a bug where the critical flag for TSA extended key usage is not always detected, and two other similar cases.
    • Add support for 'libraries/restart-without-asking', which allows services to be restarted automatically without prompting, or requiring a response instead.
    • Fix CVE-2014-0076: "Yarom/Benger FLUSH+RELOAD Cache Side-channel Attack" (Closes: #742923).

-- Raphael Geissert Thu, 17 Apr 2014 22:11:33 +0200

Most likely the best thing to do is just to wait until the package becomes available for amd64. Since i386 is a foreign architecture for your server anyway there are likely no security benefits to installing it anyway since the amd64 version will be the main one being used. Probably the i386 one is just a dependency for a peripheral package that is does not have anything running the whole time (although you would need to check all the dependencies to be certain).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.