openSUSE-SU-2026:22140-1

openSUSE-SU-2026:22140-1 · Security update for aliyun-cli

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283596). Changes for aliyun-cli: - Update to version 3.5.1 * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable cursors, structured errors with recovery guidance, and non-interactive confirmation handling (#1452). * Add offline validation and read-only plans for single-file uploads and single-object deletion; record exact failed targets in exclusive JSONL manifests for cp/sync and expose sync deletion-phase state (#1452). * Fix the OSS bridge to preserve option order and `--`, propagate parser and service errors, pass profile region/timeouts/retry budgets, and refresh host credentials at request time without injecting them into argv (#1454). * Stop replaying writes after ambiguous transport or server failures; classify retries with jittered backoff, join workers before closing reports, and fix progress data races and failure-report filename collisions (#1452). * Enforce the host safety policy for legacy OSS operations and reject unsupported preview combinations (#1452, #1454). * Harden policy parsing and environment overrides to fail closed on invalid configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`, or AI mode. * Enforce the safety policy before built-in extension dispatch (cliext/safety.go). * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447). * API alias canonicalization was reverted and held: aliases and PascalCase/ kebab-case spellings remain separate policy matches, matching command spelling exactly as typed. * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: "v1"`, and return structured startup configuration errors (#1453). * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode; expand agent detection, User-Agent attribution, and Qoder China CLI detection (#1445, #1455). * Support case-insensitive product routing for in-process OpenAPI commands (#1445). * Expose regional and VPC product endpoints through queryable product Help (#1448). * Support camel RPC flat arrays (#1456) and prefer product prefix/substring suggestions over edit distance in "Did you mean" output. * Upgrade JMESPath to support `json.Number`, preserving large-number comparison and sorting precision and fixing empty-array average semantics. * Dispatch newly installed metadata plugins in-process (#1439). * Harden plugin archive extraction, package replacement/rollback, and download URL diagnostics (#1442). * Redact JSON and form bodies based on content while preserving the encoding of original form stars; keep raw and unparseable dry-run bodies intact (#1440, #1449). * Prefer native macOS architecture packages in install.sh (#1433). * Keep prerelease tags off the stable latest pointer and fail closed when release asset downloads are incomplete (#1437). * Include cliext in required checks, fix cross-platform test failures (#1446), restore single-file entrypoint builds, and stabilize language tests. * Update the aliyun-openapi-meta submodule and release jobs. * Add the OSS automation guide (en / zh-CN), document startup errors, exit statuses and command-spelling safety matching (#1450), and add the v3.5.1 CHANGELOG entry. - from version 3.5.0 * docs: add StsToken credential mode to README by @yndu13 in (#1403) * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411) * Update Aliyun OpenAPI meta data - Update to version 3.4.11 * feat(openapi): extend --estimate-cost coverage (pricing context, SLS/openapi path, oss bridge, by-triple) and scripting contract by @api-tool-agent in (#1399) - from version 3.4.10 (no changes) - from version 3.4.9 * fix(maxc): fall back when symlink creation fails on Windows by @yndu13 in (#1390) * fix: quote-aware External process_command parsing by @yndu13 in (#1391) * fix: POSIX line-continuation in External process_command splitting by @yndu13 in (#1392) * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394) * fix: atomically write config.json via temp+rename by @yndu13 in (#1387) * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395) * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397) * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398) - Update to version 3.4.8 * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379) * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382) * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands by @CodeSpaceiiii in (#1383) * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384) * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386) * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381) * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385) * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii with @Copilot in (#1388) * Fix invisible API parameter names in help output (bold-black on dark terminals) by @mvanhorn in (#1362) * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380) * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389) - from version 3.4.7 * {plugin} Add alias support for plugin by @AllyW in (#1376) * feat(mock): add response_body_size for controllable mock stdout size by @yndu13 in (#1378) * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377) - from version 3.4.6 * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes by @LCLSpring in (#1373) * feat(mock): add delay_ms field to simulate command execution latency by @yndu13 in (#1375) - Update to version 3.4.5 * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345) * feat(config): support STS endpoint override for OIDC and role auth by @yndu13 in (#1372) - from version 3.4.4 * (no changes) - from version 3.4.3 * fix: correct valid typo in invalid command error by @yndu13 in (#1365) * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external process by @AllyW in (#1366) - from version 3.4.2 * feat(openapi): add --estimate-cost and list-supported-pricing-apis by @LCLSpring in (#1364) - Update to version 3.4.1 * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361) * {cliext} Add aliyun spark-submit by @AllyW in (#1358) - from version 3.4.0 * feat(acrutil): extract shared binary manager and add diagnosis subcommand by @copyrightpoiiiii in (#1349) * [feature] add rostran sub command by @xiao201208 in (#1350) * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306) * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343) * Feature/support anonymous by @yuexiu94 in (#1354) * feat: support retry-after policy for throttling error by @yndu13 in (#1355) - Update to version 3.3.23 * {Plugin} Allow plugins to opt out of host profile enforcement by @AllyW in (#1348) - Update to version 3.3.22 * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346) - from version 3.3.21 * {Configure} Match policy rules against the command users actually type for ROA by @AllyW in (#1344) - from version 3.3.20 * {OpenAPI} Add call context logging by @AllyW in (#1342) - from version 3.3.19 * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332) * feat(appmanager): Generalized PrepareEnv credential pass-through supports multiple authentication modes by @mengjunwei-mjw in (#1341) - from version 3.3.18 * Improve CMS2 command descriptions and clarify exception return codes by @tingbin-ctb in (#1337) * feat(iact3): add iact3 subcommand with manual upgrade by @xiao201208 in (#1336) * Add kmscli command by @oobujieshi in (#134

Fix available

Published

2026-10-19T15:31:50Z

Updated

2026-10-22T17:23:12.302647234Z

Stack: system

Check your server →