From e6db6d0d64c6ebef356b4e93ca435b54f1370dc2 Mon Sep 17 00:00:00 2001 From: Sam Doran Date: Mon, 9 Dec 2019 13:18:32 -0500 Subject: [PATCH] [stable-2.9] Handle InternalError raised by cryptography when running in FIPS mode (#65477) Since older versions of paramiko do not require cryptography, we cannot catch the exact exception from cryptography. Remove other exceptions since we're catching everything now (cherry picked from commit d35c1a435b) Co-authored-by: Sam Doran --- changelogs/fragments/fips-paramiko-import-error.yaml | 2 ++ lib/ansible/module_utils/compat/paramiko.py | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 changelogs/fragments/fips-paramiko-import-error.yaml diff --git a/changelogs/fragments/fips-paramiko-import-error.yaml b/changelogs/fragments/fips-paramiko-import-error.yaml new file mode 100644 index 00000000000..8aaea3f7376 --- /dev/null +++ b/changelogs/fragments/fips-paramiko-import-error.yaml @@ -0,0 +1,2 @@ +bugfixes: + - paramiko - catch and handle exception to prevent stack trace when running in FIPS mode diff --git a/lib/ansible/module_utils/compat/paramiko.py b/lib/ansible/module_utils/compat/paramiko.py index 89080572f45..8e09b1b893a 100644 --- a/lib/ansible/module_utils/compat/paramiko.py +++ b/lib/ansible/module_utils/compat/paramiko.py @@ -10,5 +10,8 @@ PARAMIKO_IMPORT_ERR = None paramiko = None try: import paramiko -except (ImportError, AttributeError) as err: # paramiko and gssapi are incompatible and raise AttributeError not ImportError +# paramiko and gssapi are incompatible and raise AttributeError not ImportError +# When running in FIPS mode, cryptography raises InternalError +# https://bugzilla.redhat.com/show_bug.cgi?id=1778939 +except Exception as err: PARAMIKO_IMPORT_ERR = err