Fix for CVE-2026-26007 breaks ecc

[mdeslaur]

Hi,

We have gotten a report that the fix for CVE-2026-26007 included in 46.0.5 is breaking Ansible.

Ansible now returns the following error:
fatal: [localhost]: FAILED! => changed=false
msg: Your cryptography version does not support SECP384R1

A simple reproducer for this issue is:

import cryptography.hazmat.primitives.asymmetric.ec
ecclass = cryptography.hazmat.primitives.asymmetric.ec.__dict__.get('SECP384R1')
print(ecclass)

Downstream bug report for possibly more information:
https://bugs.launchpad.net/ubuntu/+source/python-cryptography/+bug/2144373
(We had backported the security fix to our stable releases in Ubuntu, but the same issue is present in 46.0.5)

Thanks!

[alex]

I assume this is an unexpeted consequene of our deprecated utility: 0eebb9d#diff-42b5786fb7abc7aa972632f10f1a9e5e7fa2184943dda31d2671690d489c579cR461-R464

That said, accessing things via __dict__ isn't really the correct way to get attributes from a module.

[alex]

If you can point me to the actual code in ansible, I can suggest a fix.

[mdeslaur]

Yes, it appears to be caused by the deprecated utility.

Looks like the affected ansible code is here

[alex]

Huh, that's a bit perplexing, I'd expect getattr like that to work fine.

[alex]

Oh, that's because it was fixed: ansible-collections/community.crypto@911ed33

[mdeslaur]

Ah! hah, yeah looks like it was :)

[alex]

Regrettably, I don't think there's really a way for us to both fix this issue and get the deprecation warning :-(

[mdeslaur]

No problem, you can close this bug.

[alex]

Thanks, sorry about this.

[mdeslaur]

Thanks for taking a look!