April 2026 - gerrit-log - lists.osmocom.org

[XS] Change in pysim[master]: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747)
by osmith 16 Apr '26

16 Apr '26

Attention is currently required from: dexter, fixeria. osmith has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42626?usp=email ) Change subject: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747) ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42626?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510 Gerrit-Change-Number: 42626 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 10:09:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by osmith 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen, dexter. osmith has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: Code-Review-1 (1 comment) File osmo-smdpp.py: https://gerrit.osmocom.org/c/pysim/+/42625/comment/6a2b3611_64585aa9?usp=em… : PS1, Line 643: if os.path.commonprefix((os.path.realpath(path),self.upp_dir)) != self.upp_dir: The commit message doesn't make sense, given that there is `os.path.realpath(path)` already I don't see how this could be exploited... ``` >>> upp_dir = "/tmp/" >>> path = "/tmp/../etc/passwd" >>> os.path.commonprefix((os.path.realpath(path), upp_dir)) '/' >>> os.path.commonprefix((os.path.realpath(path), upp_dir)) == upp_dir False ``` -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 10:07:37 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in pysim[master]: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338)
by osmith 16 Apr '26

16 Apr '26

Attention is currently required from: dexter, fixeria. osmith has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42624?usp=email ) Change subject: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338) ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42624?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f Gerrit-Change-Number: 42624 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:54:10 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen, osmith. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: > @osmith@sysmocom. […] ... interessant für dich (wollte ich sagen ;-) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:44:00 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen, osmith. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: @osmith@sysmocom.de: Vielleicht ist das ja auch in -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:43:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: (1 comment) File osmo-smdpp.py: https://gerrit.osmocom.org/c/pysim/+/42625/comment/a195ec08_6e9030a0?usp=em… : PS1, Line 644: if not pathlib.Path(path).resolve().is_relative_to(self.upp_dir): I got the hint that resolving self.upp_dir as well might make sense in case we ever might end up using symlinks in the upp_dir. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:13:39 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[XS] Change in pysim[master]: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42624?usp=email ) Change subject: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338) ...................................................................... pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338) Root Cause: pySim-prog.py uses Python's random module (Mersenne Twister MT19937) to generate Ki and OPC — the root authentication keys for SIM cards. MT19937 is a deterministic PRNG that is not cryptographically secure. Its internal state (624 × 32-bit words, 19,937 bits) can be fully recovered after observing 624 consecutive outputs. Impact: 1. SIM Card Cloning: An attacker who determines the PRNG state can predict all Ki/OPC values generated before and after. With these keys, SIM cards can be cloned. 2. Network Authentication Bypass: Ki/OPC are used in the Milenage algorithm for 3G/4G/5G authentication. Predictable keys mean an attacker can authenticate as any subscriber whose SIM was provisioned with the weak RNG. 3. Batch Compromise: In bulk provisioning scenarios (pySim-prog's primary use case), hundreds or thousands of SIMs may be programmed sequentially. Compromising one batch means recovering the PRNG state to predict all keys. Fix: Replace random.randrange() with os.urandom() Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f --- M pySim-prog.py 1 file changed, 2 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/24/42624/1 diff --git a/pySim-prog.py b/pySim-prog.py index 3f2bb94..6111fc1 100755 --- a/pySim-prog.py +++ b/pySim-prog.py @@ -27,7 +27,6 @@ import hashlib import argparse import os -import random import re import sys import traceback @@ -436,7 +435,7 @@ if not re.match('^[0-9a-fA-F]{32}$', ki): raise ValueError('Ki needs to be 128 bits, in hex format') else: - ki = ''.join(['%02x' % random.randrange(0, 256) for i in range(16)]) + ki = os.urandom(16).hex() # OPC (random) if opts.opc is not None: @@ -447,7 +446,7 @@ elif opts.op is not None: opc = derive_milenage_opc(ki, opts.op) else: - opc = ''.join(['%02x' % random.randrange(0, 256) for i in range(16)]) + opc = os.urandom(16).hex() pin_adm = sanitize_pin_adm(opts.pin_adm, opts.pin_adm_hex) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42624?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f Gerrit-Change-Number: 42624 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in pysim[master]: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42626?usp=email ) Change subject: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747) ...................................................................... requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747) PyYAML versions 5.1–5.3.1 are vulnerable to CVE-2020-1747, which allows arbitrary code execution through yaml.FullLoader. While PyYAML 5.4+ patches this, the dependency specification (pyyaml >= 5.1) doesn't guarantee a safe version. Let's increase the requirement to version 5.4 to ensure a safe version of is used. This patch is based on suggestions from: "YanTong C <chyeyantong03(a)gmail.com>" Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510 --- M README.md M requirements.txt M setup.py 3 files changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/26/42626/1 diff --git a/README.md b/README.md index 8773356..7768b63 100644 --- a/README.md +++ b/README.md @@ -97,7 +97,7 @@ - pyscard - pyserial - pytlv - - pyyaml >= 5.1 + - pyyaml >= 5.4 - smpp.pdu (from `github.com/hologram-io/smpp.pdu`) - termcolor diff --git a/requirements.txt b/requirements.txt index 4ceec45..9088f16 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ construct>=2.10.70 bidict pyosmocom>=0.0.12 -pyyaml>=5.1 +pyyaml>=5.4 termcolor colorlog pycryptodomex diff --git a/setup.py b/setup.py index be81122..614d80b 100644 --- a/setup.py +++ b/setup.py @@ -26,7 +26,7 @@ "construct >= 2.10.70", "bidict", "pyosmocom >= 0.0.12", - "pyyaml >= 5.1", + "pyyaml >= 5.4", "termcolor", "colorlog", "pycryptodomex", -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42626?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510 Gerrit-Change-Number: 42626 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) Root Cause: os.path.commonprefix() compares strings character-by-character, NOT by path components. This is a well-known Python antipattern (Python docs explicitly warn: "this function may return invalid paths because it works a character at a time"). Attack Context: The matchingId parameter is received from a network client via the GSMA ES9+ authenticateClient API endpoint (POST to /gsma/rsp2/es9plus/authenticateClient). The SM-DP+ server is a Twisted web application listening on port 443. An unauthenticated eUICC client sends the matchingId in the ctxParamsForCommonAuthentication ASN.1 structure. Fix: Replace os.path.commonprefix() with proper path component checking: Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 --- M osmo-smdpp.py 1 file changed, 2 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/25/42625/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index d1d6fd7..74d9ab6 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -117,6 +117,7 @@ import uuid # noqa: E402 import os # noqa: E402 import functools # noqa: E402 +import pathlib from typing import Optional, Dict, List # noqa: E402 from pprint import pprint as pp # noqa: E402 @@ -640,7 +641,7 @@ # look up profile based on matchingID. We simply check if a given file exists for now.. path = os.path.join(self.upp_dir, matchingId) + '.der' # prevent directory traversal attack - if os.path.commonprefix((os.path.realpath(path),self.upp_dir)) != self.upp_dir: + if not pathlib.Path(path).resolve().is_relative_to(self.upp_dir): raise ApiError('8.2.6', '3.8', 'Refused') if not os.path.isfile(path) or not os.access(path, os.R_OK): raise ApiError('8.2.6', '3.8', 'Refused') -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in osmo-msc[master]: Check for protocol extension bit in message type at a central location
by pespin 16 Apr '26

16 Apr '26

Attention is currently required from: fixeria, jolly. pespin has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-msc/+/38579?usp=email ) Change subject: Check for protocol extension bit in message type at a central location ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/38579?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Iae41bc6a2e9fd85583509b6c6154dd5a935fb5df Gerrit-Change-Number: 38579 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 07:59:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log April 2026