{"id":"openSUSE-SU-2026:22140-1","summary":"Security update for aliyun-cli","details":"This update for aliyun-cli fixes the following issue:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283596).\n\nChanges for aliyun-cli:\n\n- Update to version 3.5.1\n * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable\n cursors, structured errors with recovery guidance, and non-interactive\n confirmation handling (#1452).\n * Add offline validation and read-only plans for single-file uploads and\n single-object deletion; record exact failed targets in exclusive JSONL\n manifests for cp/sync and expose sync deletion-phase state (#1452).\n * Fix the OSS bridge to preserve option order and `--`, propagate parser and\n service errors, pass profile region/timeouts/retry budgets, and refresh host\n credentials at request time without injecting them into argv (#1454).\n * Stop replaying writes after ambiguous transport or server failures; classify\n retries with jittered backoff, join workers before closing reports, and fix\n progress data races and failure-report filename collisions (#1452).\n * Enforce the host safety policy for legacy OSS operations and reject\n unsupported preview combinations (#1452, #1454).\n * Harden policy parsing and environment overrides to fail closed on invalid\n configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`,\n or AI mode.\n * Enforce the safety policy before built-in extension dispatch\n (cliext/safety.go).\n * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).\n * API alias canonicalization was reverted and held: aliases and PascalCase/\n kebab-case spellings remain separate policy matches, matching command\n spelling exactly as typed.\n * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: \"v1\"`,\n and return structured startup configuration errors (#1453).\n * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;\n expand agent detection, User-Agent attribution, and Qoder China CLI\n detection (#1445, #1455).\n * Support case-insensitive product routing for in-process OpenAPI commands (#1445).\n * Expose regional and VPC product endpoints through queryable product Help (#1448).\n * Support camel RPC flat arrays (#1456) and prefer product prefix/substring\n suggestions over edit distance in \"Did you mean\" output.\n * Upgrade JMESPath to support `json.Number`, preserving large-number\n comparison and sorting precision and fixing empty-array average semantics.\n * Dispatch newly installed metadata plugins in-process (#1439).\n * Harden plugin archive extraction, package replacement/rollback, and download\n URL diagnostics (#1442).\n * Redact JSON and form bodies based on content while preserving the encoding\n of original form stars; keep raw and unparseable dry-run bodies intact\n (#1440, #1449).\n * Prefer native macOS architecture packages in install.sh (#1433).\n * Keep prerelease tags off the stable latest pointer and fail closed when\n release asset downloads are incomplete (#1437).\n * Include cliext in required checks, fix cross-platform test failures (#1446),\n restore single-file entrypoint builds, and stabilize language tests.\n * Update the aliyun-openapi-meta submodule and release jobs.\n * Add the OSS automation guide (en / zh-CN), document startup errors, exit\n statuses and command-spelling safety matching (#1450), and add the v3.5.1\n CHANGELOG entry.\n- from version 3.5.0\n * docs: add StsToken credential mode to README by @yndu13 in (#1403)\n * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)\n * Update Aliyun OpenAPI meta data\n- Update to version 3.4.11\n * feat(openapi): extend --estimate-cost coverage (pricing context,\n SLS/openapi path, oss bridge, by-triple) and scripting contract\n by @api-tool-agent in (#1399)\n- from version 3.4.10\n (no changes)\n- from version 3.4.9\n * fix(maxc): fall back when symlink creation fails on Windows\n by @yndu13 in (#1390)\n * fix: quote-aware External process_command parsing by @yndu13 in (#1391)\n * fix: POSIX line-continuation in External process_command splitting\n by @yndu13 in (#1392)\n * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)\n * fix: atomically write config.json via temp+rename by @yndu13 in (#1387)\n * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)\n * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)\n * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)\n- Update to version 3.4.8\n * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)\n * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)\n * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands\n by @CodeSpaceiiii in (#1383)\n * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)\n * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)\n * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)\n * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)\n * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii\n with @Copilot in (#1388)\n * Fix invisible API parameter names in help output (bold-black on dark terminals)\n by @mvanhorn in (#1362)\n * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)\n * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)\n- from version 3.4.7\n * {plugin} Add alias support for plugin by @AllyW in (#1376)\n * feat(mock): add response_body_size for controllable mock stdout size\n by @yndu13 in (#1378)\n * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)\n- from version 3.4.6\n * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes\n by @LCLSpring in (#1373)\n * feat(mock): add delay_ms field to simulate command execution latency\n by @yndu13 in (#1375)\n- Update to version 3.4.5\n * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)\n * feat(config): support STS endpoint override for OIDC and role\n auth by @yndu13 in (#1372)\n- from version 3.4.4\n * (no changes)\n- from version 3.4.3\n * fix: correct valid typo in invalid command error by @yndu13 in (#1365)\n * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external\n process by @AllyW in (#1366)\n- from version 3.4.2\n * feat(openapi): add --estimate-cost and list-supported-pricing-apis\n by @LCLSpring in (#1364)\n- Update to version 3.4.1\n * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)\n * {cliext} Add aliyun spark-submit by @AllyW in (#1358)\n- from version 3.4.0\n * feat(acrutil): extract shared binary manager and add diagnosis\n subcommand by @copyrightpoiiiii in (#1349)\n * [feature] add rostran sub command by @xiao201208 in (#1350)\n * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)\n * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)\n * Feature/support anonymous by @yuexiu94 in (#1354)\n * feat: support retry-after policy for throttling error by @yndu13\n in (#1355)\n- Update to version 3.3.23\n * {Plugin} Allow plugins to opt out of host profile enforcement\n by @AllyW in (#1348)\n- Update to version 3.3.22\n * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)\n- from version 3.3.21\n * {Configure} Match policy rules against the command users actually type\n for ROA by @AllyW in (#1344)\n- from version 3.3.20\n * {OpenAPI} Add call context logging by @AllyW in (#1342)\n- from version 3.3.19\n * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)\n * feat(appmanager): Generalized PrepareEnv credential pass-through\n supports multiple authentication modes by @mengjunwei-mjw in (#1341)\n- from version 3.3.18\n * Improve CMS2 command descriptions and clarify exception\n return codes by @tingbin-ctb in (#1337)\n * feat(iact3): add iact3 subcommand with manual upgrade\n by @xiao201208 in (#1336)\n * Add kmscli command by @oobujieshi in (#1340)\n- from version 3.3.17\n * {Plugin} Support lang and profile from flag for plugin\n execution by @AllyW in (#1330)\n * Computenest pypi venv by @mengjunwei-mjw in (#1331)\n * feat: add codeup-cli subcommand for migrating third-party\n code repos by @imu2008 in (#1335)\n- from version 3.3.16\n * Optimize error messages by @CodeSpaceiiii in (#1327)\n * {Openapi} Return InvalidApiError for unknown API on\n restful products by @AllyW in (#1326)\n * feat(acrutil): Add Alibaba Cloud Container Registry(ACR)\n Skill management CLI subcommand by @copyrightpoiiiii in (#1329)\n * {Configure} Support BearerToken profile mode by @AllyW in (#1333)\n- from version 3.3.15\n * feat add saectl by @Beimingx in (#1319)\n * Cloud Monitor version 2.0: Independent binary access,\n Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)\n * feat(otel): integrate OpenTelemetry support with environment\n variable by @CodeSpaceiiii in (#1324)\n * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT,\n AI_USER_AGENT, and OTEL headers have been added. Issues with business\n parameter passing have been fixed by @tingbin-ctb in (#1325)\n- Update to version 3.3.14\n * feat(appmanager): add appmanager subcommand with PyPI+OSS\n dual-source by @mengjunwei-mjw in (#1317)\n * {Misc} Add --name and update version check message for plugin\n install and adjust agent detection by @AllyW in (#1316)\n- from version 3.3.13\n- Update to version 3.3.12\n * Add AgentBay CLI command and implement language setting logic\n by @CodeSpaceiiii in (#1311)\n * {Profile} Add external-account-type for user profile\n by @AllyW in (#1312)\n * Implement CLI mock command with add, import, remove, list,\n clear, and path subcommands by @CodeSpaceiiii in (#1313)\n * {Openapi} Add agent segment to user-agent by @AllyW in (#1314)\n- from version 3.3.11\n * Fix retrySaveProfile function to return success status and\n update tests by @CodeSpaceiiii in (#1310)\n- Update to version 3.3.10\n- from version 3.3.9\n * {Config} Add safety policy env parsing by @AllyW in (#1307)\n- from version 3.3.8\n * {Core} Add plugin install --package and plugin show by @AllyW in (#1301)\n- from version 3.3.7\n * {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile\n endpoint env injection by @AllyW in (#1304)\n- from version 3.3.6\n * {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)\n- from version 3.3.5\n * feat: profile support endpoint flag by @crimson-gao in (#1298)\n * {Core} Add aliyun upgrade and configurable plugin index source and\n fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)\n- Update to version 3.3.4\n * {Core} Fix unknown-flag parsing for plugin-style subcommands\n by @AllyW in (#1296)\n- from version 3.3.3\n * {Core} Add ai-mode and safety policy configuration\n by @AllyW in (#1295)\n","modified":"2026-10-22T17:23:49.074306965Z","published":"2026-10-19T15:31:50Z","related":["CVE-2026-63209"],"upstream":["CVE-2026-63209"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283596"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284203"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63209"}],"affected":[{"package":{"name":"aliyun-cli","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/aliyun-cli&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"aliyun-cli":"3.5.1-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22140-1.json"}}],"schema_version":"1.9.2"}