April 2026 - gerrit-log - lists.osmocom.org

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen, osmith. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: @osmith@sysmocom.de: Vielleicht ist das ja auch in -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:43:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... Patch Set 1: (1 comment) File osmo-smdpp.py: https://gerrit.osmocom.org/c/pysim/+/42625/comment/a195ec08_6e9030a0?usp=em… : PS1, Line 644: if not pathlib.Path(path).resolve().is_relative_to(self.upp_dir): I got the hint that resolving self.upp_dir as well might make sense in case we ever might end up using symlinks in the upp_dir. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 09:13:39 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[XS] Change in pysim[master]: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42624?usp=email ) Change subject: pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338) ...................................................................... pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338) Root Cause: pySim-prog.py uses Python's random module (Mersenne Twister MT19937) to generate Ki and OPC — the root authentication keys for SIM cards. MT19937 is a deterministic PRNG that is not cryptographically secure. Its internal state (624 × 32-bit words, 19,937 bits) can be fully recovered after observing 624 consecutive outputs. Impact: 1. SIM Card Cloning: An attacker who determines the PRNG state can predict all Ki/OPC values generated before and after. With these keys, SIM cards can be cloned. 2. Network Authentication Bypass: Ki/OPC are used in the Milenage algorithm for 3G/4G/5G authentication. Predictable keys mean an attacker can authenticate as any subscriber whose SIM was provisioned with the weak RNG. 3. Batch Compromise: In bulk provisioning scenarios (pySim-prog's primary use case), hundreds or thousands of SIMs may be programmed sequentially. Compromising one batch means recovering the PRNG state to predict all keys. Fix: Replace random.randrange() with os.urandom() Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f --- M pySim-prog.py 1 file changed, 2 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/24/42624/1 diff --git a/pySim-prog.py b/pySim-prog.py index 3f2bb94..6111fc1 100755 --- a/pySim-prog.py +++ b/pySim-prog.py @@ -27,7 +27,6 @@ import hashlib import argparse import os -import random import re import sys import traceback @@ -436,7 +435,7 @@ if not re.match('^[0-9a-fA-F]{32}$', ki): raise ValueError('Ki needs to be 128 bits, in hex format') else: - ki = ''.join(['%02x' % random.randrange(0, 256) for i in range(16)]) + ki = os.urandom(16).hex() # OPC (random) if opts.opc is not None: @@ -447,7 +446,7 @@ elif opts.op is not None: opc = derive_milenage_opc(ki, opts.op) else: - opc = ''.join(['%02x' % random.randrange(0, 256) for i in range(16)]) + opc = os.urandom(16).hex() pin_adm = sanitize_pin_adm(opts.pin_adm, opts.pin_adm_hex) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42624?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f Gerrit-Change-Number: 42624 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in pysim[master]: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42626?usp=email ) Change subject: requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747) ...................................................................... requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747) PyYAML versions 5.1–5.3.1 are vulnerable to CVE-2020-1747, which allows arbitrary code execution through yaml.FullLoader. While PyYAML 5.4+ patches this, the dependency specification (pyyaml >= 5.1) doesn't guarantee a safe version. Let's increase the requirement to version 5.4 to ensure a safe version of is used. This patch is based on suggestions from: "YanTong C <chyeyantong03(a)gmail.com>" Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510 --- M README.md M requirements.txt M setup.py 3 files changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/26/42626/1 diff --git a/README.md b/README.md index 8773356..7768b63 100644 --- a/README.md +++ b/README.md @@ -97,7 +97,7 @@ - pyscard - pyserial - pytlv - - pyyaml >= 5.1 + - pyyaml >= 5.4 - smpp.pdu (from `github.com/hologram-io/smpp.pdu`) - termcolor diff --git a/requirements.txt b/requirements.txt index 4ceec45..9088f16 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ construct>=2.10.70 bidict pyosmocom>=0.0.12 -pyyaml>=5.1 +pyyaml>=5.4 termcolor colorlog pycryptodomex diff --git a/setup.py b/setup.py index be81122..614d80b 100644 --- a/setup.py +++ b/setup.py @@ -26,7 +26,7 @@ "construct >= 2.10.70", "bidict", "pyosmocom >= 0.0.12", - "pyyaml >= 5.1", + "pyyaml >= 5.4", "termcolor", "colorlog", "pycryptodomex", -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42626?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510 Gerrit-Change-Number: 42626 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in pysim[master]: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)
by dexter 16 Apr '26

16 Apr '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/42625?usp=email ) Change subject: osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) ...................................................................... osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22) Root Cause: os.path.commonprefix() compares strings character-by-character, NOT by path components. This is a well-known Python antipattern (Python docs explicitly warn: "this function may return invalid paths because it works a character at a time"). Attack Context: The matchingId parameter is received from a network client via the GSMA ES9+ authenticateClient API endpoint (POST to /gsma/rsp2/es9plus/authenticateClient). The SM-DP+ server is a Twisted web application listening on port 443. An unauthenticated eUICC client sends the matchingId in the ctxParamsForCommonAuthentication ASN.1 structure. Fix: Replace os.path.commonprefix() with proper path component checking: Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 --- M osmo-smdpp.py 1 file changed, 2 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/25/42625/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index d1d6fd7..74d9ab6 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -117,6 +117,7 @@ import uuid # noqa: E402 import os # noqa: E402 import functools # noqa: E402 +import pathlib from typing import Optional, Dict, List # noqa: E402 from pprint import pprint as pp # noqa: E402 @@ -640,7 +641,7 @@ # look up profile based on matchingID. We simply check if a given file exists for now.. path = os.path.join(self.upp_dir, matchingId) + '.der' # prevent directory traversal attack - if os.path.commonprefix((os.path.realpath(path),self.upp_dir)) != self.upp_dir: + if not pathlib.Path(path).resolve().is_relative_to(self.upp_dir): raise ApiError('8.2.6', '3.8', 'Refused') if not os.path.isfile(path) or not os.access(path, os.R_OK): raise ApiError('8.2.6', '3.8', 'Refused') -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42625?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828 Gerrit-Change-Number: 42625 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in osmo-msc[master]: Check for protocol extension bit in message type at a central location
by pespin 16 Apr '26

16 Apr '26

Attention is currently required from: fixeria, jolly. pespin has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-msc/+/38579?usp=email ) Change subject: Check for protocol extension bit in message type at a central location ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/38579?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Iae41bc6a2e9fd85583509b6c6154dd5a935fb5df Gerrit-Change-Number: 38579 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 16 Apr 2026 07:59:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-msc[master]: Reset 'release_99' flag in test cases at comment_start()
by pespin 16 Apr '26

16 Apr '26

Attention is currently required from: jolly. pespin has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-msc/+/42623?usp=email ) Change subject: Reset 'release_99' flag in test cases at comment_start() ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/42623?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I55a49dd24a5df6ee8e28fa6b410988e82d10c554 Gerrit-Change-Number: 42623 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Thu, 16 Apr 2026 07:59:29 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ccid-firmware[master]: octsim: main: document the fixed allocation sizes for msgb
by lynxis lazus 15 Apr '26

15 Apr '26

Attention is currently required from: Hoernchen. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42620?usp=email ) Change subject: octsim: main: document the fixed allocation sizes for msgb ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: > the whole point was kinda to have one single allocation size and no heap fragmentation.. Ok, I'll rework this commit and document the idea behind it. -- To view, visit https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42620?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ccid-firmware Gerrit-Branch: master Gerrit-Change-Id: I33809d2c1973231627f6da5d9b01e9525f2b38c1 Gerrit-Change-Number: 42620 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Wed, 15 Apr 2026 17:15:52 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Hoernchen <ewild(a)sysmocom.de>

1 0

[XS] Change in osmo-ccid-firmware[master]: octsim: main: document the fixed allocation sizes for msgb
by lynxis lazus 15 Apr '26

15 Apr '26

Attention is currently required from: lynxis lazus. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42620?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: octsim: main: document the fixed allocation sizes for msgb ...................................................................... octsim: main: document the fixed allocation sizes for msgb Use the same allocation for all msgb to prevent heap allocation fragmentation. Add a comment to document it. Change-Id: I33809d2c1973231627f6da5d9b01e9525f2b38c1 --- M sysmoOCTSIM/main.c 1 file changed, 6 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ccid-firmware refs/changes/20/42620/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42620?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ccid-firmware Gerrit-Branch: master Gerrit-Change-Id: I33809d2c1973231627f6da5d9b01e9525f2b38c1 Gerrit-Change-Number: 42620 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in osmo-ccid-firmware[master]: octsim: usb_descriptor: reduce IRQ endpoint max packet size to 4 bytes
by lynxis lazus 15 Apr '26

15 Apr '26

Attention is currently required from: Hoernchen. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42619?usp=email ) Change subject: octsim: usb_descriptor: reduce IRQ endpoint max packet size to 4 bytes ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: > see https://gerrit.osmocom. […] As I understand the IRQs on USB, the EP size is relevant for scheduling the bus and the bus will reserve bandwidth for IRQs. Especially for the simbank with 24 devices, this might be relevant. The linter has other problems, it wants to format untouched things, not the changed line. As already written, this needs testing. -- To view, visit https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42619?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ccid-firmware Gerrit-Branch: master Gerrit-Change-Id: I615ff16d9bc0e8d39156015e41b4abe4502aaca1 Gerrit-Change-Number: 42619 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Wed, 15 Apr 2026 17:07:36 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Hoernchen <ewild(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log April 2026