Ansible OpenSSL Error with apt module

Question

This is rather odd, I noticed it yesterday on one of my target machines, and today its happening on the rest of them too. I also tried running the playbook from a different machine and the same thing happened. It seems like this problem occurs after an apt upgrade on Ubuntu 20.04. The first time the apt upgrade goes through, all is well, but after that the module begins to fail.

The error output is as follows:

TASK [common : Update package manager] *************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AttributeError: module 'lib
' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
fatal: [mr-bones]: FAILED! => changed=false
  module_stderr: |-
    Traceback (most recent call last):
      File "<stdin>", line 107, in <module>
      File "<stdin>", line 99, in _ansiballz_main
      File "<stdin>", line 47, in invoke_module
      File "/usr/lib/python3.8/runpy.py", line 207, in run_module
        return _run_module_code(code, init_globals, run_name, mod_spec)
      File "/usr/lib/python3.8/runpy.py", line 97, in _run_module_code
        _run_code(code, mod_globals, init_globals,
      File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
        exec(code, run_globals)
      File "/tmp/ansible_apt_payload_vpe7xcy0/ansible_apt_payload.zip/ansible/modules/apt.py", line 346, in <module>
      File "<frozen importlib._bootstrap>", line 991, in _find_and_load
      File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
      File "<frozen importlib._bootstrap>", line 655, in _load_unlocked
      File "<frozen importlib._bootstrap>", line 618, in _load_backward_compatible
      File "<frozen zipimport>", line 259, in load_module
      File "/tmp/ansible_apt_payload_vpe7xcy0/ansible_apt_payload.zip/ansible/module_utils/urls.py", line 115, in <module>
      File "/usr/local/lib/python3.8/dist-packages/urllib3/contrib/pyopenssl.py", line 50, in <module>
        import OpenSSL.SSL
      File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module>
        from OpenSSL import crypto, SSL
      File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1553, in <module>
        class X509StoreFlags(object):
      File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1573, in X509StoreFlags
        CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
    AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
  module_stdout: ''
  msg: |-
    MODULE FAILURE
    See stdout/stderr for the exact error
  rc: 1

I should note that commands like sudo apt-get upgrade work just fine on the target machine without ansible.

Has anyone else encountered this? Should I report this as a bug to the ansible folks on github?

EDIT: I did some more digging and apparently this affects other ansible modules like get_url, which points me to the idea that this is a Python/OpenSSL error, rather that something to do with apt

Answer 1

I had similar issue today and investigations pointed to same direction.

We are using pyOpenSSL and have locked to older version. It's using the latest cryptography library version with requirement cryptography>=2.8.

So, the unexpectedly changed version was the cryptography 36.0.2 -> 37.0.0 that happened April 26th (yesterday). Using the older 36.0.2 fixed the problem in my case since locking to that version was not a problem.

Based on the error message Ansible might have a similar problem since seems to be using pyOpenSSL and importing OpenSSL is giving the error as in my case.

Update:
As mentioned in comments the latest pyOpenSSL version likely does not have this issue. So, if you just want to quickly revert the change that caused the problem, revert the cryptography library update in some way. Better solution is to upgrade pyOpenSSL to the latest version, if you have time to test it properly.

Answer 2

Package maintainers have deployed v37.0.1 which includes (https://github.com/pyca/cryptography/commit/3fb93cfde75d073a91bc4a73a51f62962092501e):

• Restored some legacy symbols for older pyOpenSSL users. These will be removed again in the future, so pyOpenSSL users should still upgrade to the latest version of that package when they upgrade cryptography.

So upgrading to cryptography v37.0.1 should work regardless of your pyOpenSSL version but as noted, these changes will be reintroduced at a later date so as @Miika has suggested, upgrading is the better way to go if you are able.

Answer 3

For my environment that uses python 3.8, upgrading pyopenssl to 22.0.0 with cryptography at 37.0.0 fixed the issue.

Answer 4

Python3.7 en virtualenv

pip install cryptography==37.0.0

Change per solve issue

pip install cryptography==36.0.0

Answer 5

I got this error with AWX configured with default AWX-EE (Latest) with another module.

The new AWX-EE released today (April 27th 2022) generates the same issue for some modules (at least one on my side)

Changing AWX-EE to version 0.6.0 solved the issue.