diff --git a/changelogs/fragments/67515-openssl-fingerprint-fips.yml b/changelogs/fragments/67515-openssl-fingerprint-fips.yml new file mode 100644 index 00000000000..18738d1f687 --- /dev/null +++ b/changelogs/fragments/67515-openssl-fingerprint-fips.yml @@ -0,0 +1,2 @@ +bugfixes: +- "openssl_* modules - prevent crash on fingerprint determination in FIPS mode (https://github.com/ansible/ansible/issues/67213)." diff --git a/lib/ansible/module_utils/crypto.py b/lib/ansible/module_utils/crypto.py index d35d4f363e3..e8c26aa7f75 100644 --- a/lib/ansible/module_utils/crypto.py +++ b/lib/ansible/module_utils/crypto.py @@ -154,7 +154,12 @@ def get_fingerprint_of_bytes(source): for algo in algorithms: f = getattr(hashlib, algo) - h = f(source) + try: + h = f(source) + except ValueError: + # This can happen for hash algorithms not supported in FIPS mode + # (https://github.com/ansible/ansible/issues/67213) + continue try: # Certain hash functions have a hexdigest() which expects a length parameter pubkey_digest = h.hexdigest()