From d35c1a435bd8d61069e6370dfc1e1de143ca4c43 Mon Sep 17 00:00:00 2001 From: Sam Doran Date: Mon, 9 Dec 2019 13:18:32 -0500 Subject: [PATCH] Handle InternalError raised by cryptography when running in FIPS mode (#65477) Since older versions of paramiko do not require cryptography, we cannot catch the exact exception from cryptography. Remove other exceptions since we're catching everything now --- changelogs/fragments/fips-paramiko-import-error.yaml | 2 ++ lib/ansible/module_utils/compat/paramiko.py | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 changelogs/fragments/fips-paramiko-import-error.yaml diff --git a/changelogs/fragments/fips-paramiko-import-error.yaml b/changelogs/fragments/fips-paramiko-import-error.yaml new file mode 100644 index 00000000000..8aaea3f7376 --- /dev/null +++ b/changelogs/fragments/fips-paramiko-import-error.yaml @@ -0,0 +1,2 @@ +bugfixes: + - paramiko - catch and handle exception to prevent stack trace when running in FIPS mode diff --git a/lib/ansible/module_utils/compat/paramiko.py b/lib/ansible/module_utils/compat/paramiko.py index 89080572f45..8e09b1b893a 100644 --- a/lib/ansible/module_utils/compat/paramiko.py +++ b/lib/ansible/module_utils/compat/paramiko.py @@ -10,5 +10,8 @@ PARAMIKO_IMPORT_ERR = None paramiko = None try: import paramiko -except (ImportError, AttributeError) as err: # paramiko and gssapi are incompatible and raise AttributeError not ImportError +# paramiko and gssapi are incompatible and raise AttributeError not ImportError +# When running in FIPS mode, cryptography raises InternalError +# https://bugzilla.redhat.com/show_bug.cgi?id=1778939 +except Exception as err: PARAMIKO_IMPORT_ERR = err