From df2ecd07f702b2ec5d4fe9e732106e2e07dc3195 Mon Sep 17 00:00:00 2001 From: mjohns91 Date: Mon, 14 Sep 2026 15:17:39 -0400 Subject: [PATCH] fix: add _aes attribute to Fernet256 for cryptography>=50.0.0 compatibility Cryptography 50.0.0 added a self._aes attribute to the Fernet class constructor. Since Fernet256 overrides __init__ without calling super().__init__(), it needs to manually set this attribute. Without this attribute, any code using Fernet256 (encryption/decryption of credentials, secrets, etc.) fails with: AttributeError: 'Fernet256' object has no attribute '_aes' This fix: - Imports algorithms from cryptography.hazmat.primitives.ciphers - Sets self._aes = algorithms.AES(self._encryption_key) in __init__ The fix is backward compatible with cryptography < 50.0.0 since the _aes attribute wasn't used by Fernet's methods in older versions. Fixes: 277 test failures in AWX test suite when using cryptography 50.x Related: pyca/cryptography#11234 (cryptography 50.0.0 changes) --- awx/main/utils/encryption.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/awx/main/utils/encryption.py b/awx/main/utils/encryption.py index d23685d33456..5ece1997ab7c 100644 --- a/awx/main/utils/encryption.py +++ b/awx/main/utils/encryption.py @@ -7,6 +7,7 @@ from cryptography.fernet import Fernet, InvalidToken from cryptography.hazmat.backends import default_backend +from cryptography.hazmat.primitives.ciphers import algorithms from django.utils.encoding import smart_str, smart_bytes __all__ = ['get_encryption_key', 'encrypt_field', 'decrypt_field', 'encrypt_value', 'decrypt_value', 'encrypt_dict'] @@ -30,6 +31,8 @@ def __init__(self, key, backend=None): self._signing_key = key[:32] self._encryption_key = key[32:] self._backend = backend + # Required for compatibility with cryptography >= 50.0.0 + self._aes = algorithms.AES(self._encryption_key) def get_encryption_key(field_name, pk=None, secret_key=None):