External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-10-29 22:03:20 -02:30
Code Issues Packages Projects Releases Wiki Activity

Bump PyJWT to address CVE-2026-102268 (#16748)

Browse Source 
* Bump PyJWT to address CVE-2026-102268

Pin PyJWT>=2.14.0 in requirements.in to address CVE-2026-102268
(authentication bypass via improper public key validation).
Regenerated requirements.txt via make docker_update_requirements.

Assisted-By: Claude Code
Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>

* Use a 32+ byte HMAC key in workload identity tests

PyJWT >= 2.11 emits InsecureKeyLengthWarning for HS256 keys shorter
than 32 bytes, which pytest's filterwarnings=error turns into an
exception that populate_workload_identity_tokens swallows, so the
Gateway request is never made.

Assisted-By: Claude Code
Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>

---------

Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>
This commit is contained in:
Rodrigo Toshiaki Horie
2026-10-27 09:28:31 -03:00
committed by GitHub
parent edabe5d6eb
commit 5333d0d1f9
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
awx/main/tests/functional/test_jobs.py
+3 -3
View File
@@ -468,7 +468,7 @@ def test_run_job_cloud_credentials(job_template_with_credentials):
@pytest.mark.django_db
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_credentials, mocker):
"""Test populate_workload_identity_tokens sets context when flag is enabled."""
with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'):
@@ -529,7 +529,7 @@ def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_c
@pytest.mark.django_db
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
def test_populate_workload_identity_tokens_passes_workload_ttl_from_job_timeout(job_template_with_credentials, mocker):
"""Test populate_workload_identity_tokens passes workload_ttl_seconds from get_instance_timeout to the client."""
with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'):
@@ -628,7 +628,7 @@ def test_populate_workload_identity_tokens_with_flag_disabled(job_template_with_
@pytest.mark.django_db
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
def test_populate_workload_identity_tokens_multiple_input_sources_per_credential(job_template_with_credentials, mocker):
"""Test that a single credential with two input sources from different workload identity
credential types gets a separate JWT token for each input source, keyed by input source PK."""
requirements/requirements.in
+1
View File
@@ -49,6 +49,7 @@ psutil
pyasn1>=0.6.2 # CVE-2026-2349
pygerduty
PyGithub
PyJWT>=2.14.0 # CVE-2026-102268
pyopenssl
pyparsing>3.0 # Upgraded to v3 and changed import patterns
python-daemon
requirements/requirements.txt
+2 -1
View File
@@ -384,8 +384,9 @@ pygithub==2.8.1
# via
# -r /awx_devel/requirements/requirements.in
# awx-plugins-core
pyjwt[crypto]==2.10.1
pyjwt[crypto]==2.15.1
# via
# -r /awx_devel/requirements/requirements.in
# adal
# django-ansible-base
# msal