Skip to content

Decrypt Protected Settings in VMSnapshot Extension for FIPS 140-3 AES256 support and backward compatibility for DES_EDE3_CBC encryption#2122

Merged
deveshjagwani merged 4 commits intomasterfrom
dev/dejagwan/fips140
Mar 13, 2026
Merged

Decrypt Protected Settings in VMSnapshot Extension for FIPS 140-3 AES256 support and backward compatibility for DES_EDE3_CBC encryption#2122
deveshjagwani merged 4 commits intomasterfrom
dev/dejagwan/fips140

Conversation

@deveshjagwani
Copy link
Copy Markdown
Contributor

FedRamp requirement security task: 34614091

@deveshjagwani deveshjagwani changed the title Decrypt protected settings with FIPS 140-3 AES256 support and backward compatibility for DES_EDE3_CBC encryption Decrypt Protected Settings in VMSnapshot Extension for FIPS 140-3 AES256 support and backward compatibility for DES_EDE3_CBC encryption Nov 3, 2025
Comment thread VMBackup/main/Utils/HandlerUtil.py
Comment thread VMBackup/main/Utils/HandlerUtil.py
Comment thread VMBackup/main/Utils/HandlerUtil.py
Comment thread VMBackup/main/Utils/HandlerUtil.py
…config

- Suppress waagent internal logging of decryption commands (chk_err=False, log_cmd=False)
- Log only exception type name instead of full message in CMS/SMIME except blocks
- Remove raw settings content from JSON error messages
- Move 'Config decoded correctly' log inside try block so it only logs on success
@arisettisanjana
Copy link
Copy Markdown
Contributor

guest side path is validated right?

@deveshjagwani deveshjagwani merged commit 41f38fb into master Mar 13, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants