Open taylorb-syd opened 4 years ago
👍 for fixing this.
not actually disabled, the patch https://github.com/python/cpython/pull/16044/files#diff-04e8e8496549dc7aaaf50466bb5c87e6R84-R88 has been applied in FIPS enabled python. modifying the function call to hashlib.md5()
to add usedforsecurity=false
, or possibly doing somryhing like:
try:
hashlib.md5("blah")
except ValueError e:
# throws value errors for issues with FIPS
hashlib.md5("blah", usedforsecurity=False)
1. Title
AWS::CloudFormation::Init
2. Scope of request
AWS::CloudFormation::Init - Helper scripts FIPS compliance
3. Expected behaviour
When performing FIPS validation the
cfn-init
,cfn-signal
tools should pass FIPS validation and not use any non-FIPS compliance algorithms and hashes.4. Suggest specific test cases
cfn-init
testing common modules.5. Helpful Links to speed up research and evaluation
[1] How RHEL 8 is designed for FIPS 140-2 requirements
[2] Enable FIPS 140-2 Mode on Amazon Linux 2
6. Category (required)
7. Any additional context (optional)
When using the
cfn-init
tool with FIPS 140-2 enabled you will get an error similar to:This error is likely due to using MD5 hash verification in the
cfn-init
tool which is disabled in a FIPS 140-2 enabled instance.