fix(python): connect once during `trezorctl get-session`
What the developer wrote
Authored by Roman Zeyde
fix(python): connect once during `trezorctl get-session`
What changed, and why it matters
This is a small bug fix in the Trezor command-line tool `trezorctl`. The `get-session` command accidentally connected to the Trezor device twice because it used an existing connection object (`obj`) that already had an open session, then called `get_session()` again. The fix reuses the already-open `client` connection instead. This is a reliability/usability fix, not a security vulnerability. There is no indication it could be exploited to steal funds, keys, or bypass protections.
No security action required. Treat as a normal reliability fix. Users of `trezorctl` may update at their convenience; the change only avoids an unnecessary second device connection.
Security signals we found
No security-relevant keywords in commit title or message
No CVE, advisory, or security attribution in commit or changelog
Change is confined to CLI Python client behavior
No firmware or device-side code modified
Fix addresses redundant connection, not privilege escalation or data leakage
Evidence from the diff
In python/src/trezorlib/cli/trezorctl.py, the get_session CLI command previously called obj.get_session() after already entering a with obj.client.context() as client: block. This caused a second connection/session acquisition. The patch moves the get_session call onto client inside the context manager, ensuring only one connection is opened. The changelog fragment confirms the intent: ‘Connect once during trezorctl get-session.’ No cryptographic, authentication, or firmware security boundary is changed.
Changed components
python/src/trezorlib/cli/trezorctl.py`trezorctl get-session` CLI commandInspect captured patch +6 / −5
diff --git a/python/.changelog.d/6009.fixed b/python/.changelog.d/6009.fixed
new file mode 100644
index 000000000..66d643116
--- /dev/null
+++ b/python/.changelog.d/6009.fixed
@@ -0,0 +1 @@
+Connect once during `trezorctl get-session`.
diff --git a/python/src/trezorlib/cli/trezorctl.py b/python/src/trezorlib/cli/trezorctl.py
index 5b21a3518..aba13b343 100755
--- a/python/src/trezorlib/cli/trezorctl.py
+++ b/python/src/trezorlib/cli/trezorctl.py
@@ -360,11 +360,11 @@ def get_session(obj: TrezorConnection, derive_cardano: bool = False) -> str:
"Upgrade your firmware to enable session support."
)
- session = obj.get_session(derive_cardano=derive_cardano)
- if session.id is None:
- raise click.ClickException("Passphrase not enabled or firmware too old.")
- else:
- return session.id.hex()
+ session = client.get_session(derive_cardano=derive_cardano)
+ if session.id is None:
+ raise click.ClickException("Passphrase not enabled or firmware too old.")
+ else:
+ return session.id.hex()
@cli.command()
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.