{"id":"openSUSE-SU-2026:22241-1","summary":"Security update for aliyun-cli","details":"This update for aliyun-cli fixes the following issue:\n\n- CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the\n  streaming decoder panic (bsc#1288500).\n\nUpdate to version 3.5.2:\n\n * fix: preserve command targets with leading --force by @pl0301 in (#1459)\n * fix(argparser): preserve object-like input in string arrays and\n stop consuming tokens after a complete JSON array by @AllyW in (#1463)\n * fix: read product help endpoints from canonical version metadata\n by @pl0301 in (#1466)\n * Fixed the issue of incorrect API parameter name values displayed by\n --help in non-plugin paths. by @yuexiu94 in (#1470)\n * fix: improve unknown OSS option diagnostics by @PanPanZou in (#1464)\n * fix: surface real pip error when plugin install fails (#1409)\n by @mengjunwei-mjw in (#1479)\n * fix: update Go security baseline and dependencies by @PanPanZou in (#1477)\n * fix: require HTTPS and checksums for plugin package installs\n by @yndu13 in (#1469)\n * fix: OAuth callback binding and add --no-browser login by @AllyW in (#1461)\n * fix: emit structured profile configuration errors in AI mode\n by @pl0301 in (#1476)\n * test: expand CLI unit coverage and failure recovery checks\n by @PanPanZou in (#1478)\n * fix: honor config path when refreshing OAuth and CloudSSO credentials\n by @PanPanZou in (#1468)\n * feat: support CLI credentials in MCP proxy by @PanPanZou in (#1465)\n * Sign release archives and publish an SBOM and provenance for each one\n by @yndu13 in (#1473)\n * fix: clarify safety policy configuration and confirmation boundaries\n by @Winphies in (#1480)\n * feat(openapi): tell \"confirmed free\" apart from \"cannot be quoted\" in\n --estimate-cost by @api-tool-agent in (#1410)\n * feat: apply API metadata read timeout defaults by @pl0301 in (#1475)\n * Add shared CloudSSO sessions across profiles by @AllyW in (#1481)\n * fix: validate JSON parameters as parent values by @Winphies in (#1485)\n","modified":"2026-11-11T17:23:13.668247182Z","published":"2026-11-04T09:26:42Z","related":["CVE-2026-116591"],"upstream":["CVE-2026-116591"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288500"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116591"}],"affected":[{"package":{"name":"aliyun-cli","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/aliyun-cli&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"aliyun-cli":"3.5.2-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22241-1.json"}}],"schema_version":"1.9.2"}