SUSE-SU-2026:24652-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202624652-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24652-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:24652-1
- Upstream
- Related
- Published
- 2026-11-04T09:25:58Z
- Modified
- 2026-11-12T17:23:19Z
- Summary
- Security update for aliyun-cli
- Details
-
This update for aliyun-cli fixes the following issue:
- CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic (bsc#1288500).
Update to version 3.5.2:
- fix: preserve command targets with leading --force by @pl0301 in (#1459)
- fix(argparser): preserve object-like input in string arrays and stop consuming tokens after a complete JSON array by @AllyW in (#1463)
- fix: read product help endpoints from canonical version metadata by @pl0301 in (#1466)
- Fixed the issue of incorrect API parameter name values displayed by --help in non-plugin paths. by @yuexiu94 in (#1470)
- fix: improve unknown OSS option diagnostics by @PanPanZou in (#1464)
- fix: surface real pip error when plugin install fails (#1409) by @mengjunwei-mjw in (#1479)
- fix: update Go security baseline and dependencies by @PanPanZou in (#1477)
- fix: require HTTPS and checksums for plugin package installs by @yndu13 in (#1469)
- fix: OAuth callback binding and add --no-browser login by @AllyW in (#1461)
- fix: emit structured profile configuration errors in AI mode by @pl0301 in (#1476)
- test: expand CLI unit coverage and failure recovery checks by @PanPanZou in (#1478)
- fix: honor config path when refreshing OAuth and CloudSSO credentials by @PanPanZou in (#1468)
- feat: support CLI credentials in MCP proxy by @PanPanZou in (#1465)
- Sign release archives and publish an SBOM and provenance for each one by @yndu13 in (#1473)
- fix: clarify safety policy configuration and confirmation boundaries by @Winphies in (#1480)
- feat(openapi): tell "confirmed free" apart from "cannot be quoted" in --estimate-cost by @api-tool-agent in (#1410)
- feat: apply API metadata read timeout defaults by @pl0301 in (#1475)
- Add shared CloudSSO sessions across profiles by @AllyW in (#1481)
- fix: validate JSON parameters as parent values by @Winphies in (#1485)
- References
Affected packages
SUSE:Linux Enterprise Server 16.0 / aliyun-cli
Package
- Name
- aliyun-cli
- Purl
- pkg:rpm/suse/aliyun-cli&distro=SUSE%20Linux%20Enterprise%20Server%2016.0