From 8b6870d7eec1936a1b0019d77708182029c43642 Mon Sep 17 00:00:00 2001 From: Matthew Johnson <90540643+mjohns91@users.noreply.github.com> Date: Thu, 17 Sep 2026 08:18:10 -0400 Subject: [PATCH] fix: add _aes attribute to Fernet256 for cryptography>=50.0.0 compatibility (#16654) Cryptography 50.0.0 added a self._aes attribute to the Fernet class constructor. Since Fernet256 overrides __init__ without calling super().__init__(), it needs to manually set this attribute. Without this attribute, any code using Fernet256 (encryption/decryption of credentials, secrets, etc.) fails with: AttributeError: 'Fernet256' object has no attribute '_aes' This fix: - Imports algorithms from cryptography.hazmat.primitives.ciphers - Sets self._aes = algorithms.AES(self._encryption_key) in __init__ The fix is backward compatible with cryptography < 50.0.0 since the _aes attribute wasn't used by Fernet's methods in older versions. Fixes: 277 test failures in AWX test suite when using cryptography 50.x Related: pyca/cryptography#11234 (cryptography 50.0.0 changes) Co-authored-by: Stevenson Michel --- awx/main/utils/encryption.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/awx/main/utils/encryption.py b/awx/main/utils/encryption.py index d23685d334..5ece1997ab 100644 --- a/awx/main/utils/encryption.py +++ b/awx/main/utils/encryption.py @@ -7,6 +7,7 @@ from collections import namedtuple from cryptography.fernet import Fernet, InvalidToken from cryptography.hazmat.backends import default_backend +from cryptography.hazmat.primitives.ciphers import algorithms from django.utils.encoding import smart_str, smart_bytes __all__ = ['get_encryption_key', 'encrypt_field', 'decrypt_field', 'encrypt_value', 'decrypt_value', 'encrypt_dict'] @@ -30,6 +31,8 @@ class Fernet256(Fernet): self._signing_key = key[:32] self._encryption_key = key[32:] self._backend = backend + # Required for compatibility with cryptography >= 50.0.0 + self._aes = algorithms.AES(self._encryption_key) def get_encryption_key(field_name, pk=None, secret_key=None):