openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)

high Nessus Plugin ID 370414

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory.

This update for aliyun-cli fixes the following issue:

- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283596).

Changes for aliyun-cli:

- Update to version 3.5.1
* Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable cursors, structured errors with recovery guidance, and non-interactive confirmation handling (#1452).
* Add offline validation and read-only plans for single-file uploads and single-object deletion; record exact failed targets in exclusive JSONL manifests for cp/sync and expose sync deletion-phase state (#1452).
* Fix the OSS bridge to preserve option order and `--`, propagate parser and service errors, pass profile region/timeouts/retry budgets, and refresh host credentials at request time without injecting them into argv (#1454).
* Stop replaying writes after ambiguous transport or server failures; classify retries with jittered backoff, join workers before closing reports, and fix progress data races and failure-report filename collisions (#1452).
* Enforce the host safety policy for legacy OSS operations and reject unsupported preview combinations (#1452, #1454).
* Harden policy parsing and environment overrides to fail closed on invalid configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`, or AI mode.
* Enforce the safety policy before built-in extension dispatch (cliext/safety.go).
* Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
* API alias canonicalization was reverted and held: aliases and PascalCase/ kebab-case spellings remain separate policy matches, matching command spelling exactly as typed.
* Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: v1`, and return structured startup configuration errors (#1453).
* Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;
expand agent detection, User-Agent attribution, and Qoder China CLI detection (#1445, #1455).
* Support case-insensitive product routing for in-process OpenAPI commands (#1445).
* Expose regional and VPC product endpoints through queryable product Help (#1448).
* Support camel RPC flat arrays (#1456) and prefer product prefix/substring suggestions over edit distance in Did you mean output.
* Upgrade JMESPath to support `json.Number`, preserving large-number comparison and sorting precision and fixing empty-array average semantics.
* Dispatch newly installed metadata plugins in-process (#1439).
* Harden plugin archive extraction, package replacement/rollback, and download URL diagnostics (#1442).
* Redact JSON and form bodies based on content while preserving the encoding of original form stars; keep raw and unparseable dry-run bodies intact (#1440, #1449).
* Prefer native macOS architecture packages in install.sh (#1433).
* Keep prerelease tags off the stable latest pointer and fail closed when release asset downloads are incomplete (#1437).
* Include cliext in required checks, fix cross-platform test failures (#1446), restore single-file entrypoint builds, and stabilize language tests.
* Update the aliyun-openapi-meta submodule and release jobs.
* Add the OSS automation guide (en / zh-CN), document startup errors, exit statuses and command-spelling safety matching (#1450), and add the v3.5.1 CHANGELOG entry.
- from version 3.5.0
* docs: add StsToken credential mode to README by @yndu13 in (#1403)
* Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
* Update Aliyun OpenAPI meta data
- Update to version 3.4.11
* feat(openapi): extend --estimate-cost coverage (pricing context, SLS/openapi path, oss bridge, by-triple) and scripting contract by @api-tool-agent in (#1399)
- from version 3.4.10 (no changes)
- from version 3.4.9
* fix(maxc): fall back when symlink creation fails on Windows by @yndu13 in (#1390)
* fix: quote-aware External process_command parsing by @yndu13 in (#1391)
* fix: POSIX line-continuation in External process_command splitting by @yndu13 in (#1392)
* Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
* fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
* fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
* feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
* fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)
- Update to version 3.4.8
* fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
* fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
* feat(openapi): add --cli-dry-run flag for built-in PascalCase commands by @CodeSpaceiiii in (#1383)
* fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
* fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
* feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
* fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
* fix: correct import order in openapi/library_test.go by @CodeSpaceiiii with @Copilot in (#1388)
* Fix invisible API parameter names in help output (bold-black on dark terminals) by @mvanhorn in (#1362)
* feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
* fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)
- from version 3.4.7
* {plugin} Add alias support for plugin by @AllyW in (#1376)
* feat(mock): add response_body_size for controllable mock stdout size by @yndu13 in (#1378)
* fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)
- from version 3.4.6
* feat(openapi): add --estimate-cost-context to pass PricingContext to quotes by @LCLSpring in (#1373)
* feat(mock): add delay_ms field to simulate command execution latency by @yndu13 in (#1375)
- Update to version 3.4.5
* [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
* feat(config): support STS endpoint override for OIDC and role auth by @yndu13 in (#1372)
- from version 3.4.4
* (no changes)
- from version 3.4.3
* fix: correct valid typo in invalid command error by @yndu13 in (#1365)
* {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external process by @AllyW in (#1366)
- from version 3.4.2
* feat(openapi): add --estimate-cost and list-supported-pricing-apis by @LCLSpring in (#1364)
- Update to version 3.4.1
* [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
* {cliext} Add aliyun spark-submit by @AllyW in (#1358)
- from version 3.4.0
* feat(acrutil): extract shared binary manager and add diagnosis subcommand by @copyrightpoiiiii in (#1349)
* [feature] add rostran sub command by @xiao201208 in (#1350)
* {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
* {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
* Feature/support anonymous by @yuexiu94 in (#1354)
* feat: support retry-after policy for throttling error by @yndu13 in (#1355)
- Update to version 3.3.23
* {Plugin} Allow plugins to opt out of host profile enforcement by @AllyW in (#1348)
- Update to version 3.3.22
* {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
- from version 3.3.21
* {Configure} Match policy rules against the command users actually type for ROA by @AllyW in (#1344)
- from version 3.3.20
* {OpenAPI} Add call context logging by @AllyW in (#1342)
- from version 3.3.19
* [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
* feat(appmanager): Generalized PrepareEnv credential pass-through supports multiple authentication modes by @mengjunwei-mjw in (#1341)
- from version 3.3.18
* Improve CMS2 command descriptions and clarify exception return codes by @tingbin-ctb in (#1337)
* feat(iact3): add iact3 subcommand with manual upgrade by @xiao201208 in (#1336)
* Add kmscli command by @oobujieshi in (#1340)
- from version 3.3.17
* {Plugin} Support lang and profile from flag for plugin execution by @AllyW in (#1330)
* Computenest pypi venv by @mengjunwei-mjw in (#1331)
* feat: add codeup-cli subcommand for migrating third-party code repos by @imu2008 in (#1335)
- from version 3.3.16
* Optimize error messages by @CodeSpaceiiii in (#1327)
* {Openapi} Return InvalidApiError for unknown API on restful products by @AllyW in (#1326)
* feat(acrutil): Add Alibaba Cloud Container Registry(ACR) Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
* {Configure} Support BearerToken profile mode by @AllyW in (#1333)
- from version 3.3.15
* feat add saectl by @Beimingx in (#1319)
* Cloud Monitor version 2.0: Independent binary access, Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
* feat(otel): integrate OpenTelemetry support with environment variable by @CodeSpaceiiii in (#1324)
* aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT, AI_USER_AGENT, and OTEL headers have been added. Issues with business parameter passing have been fixed by @tingbin-ctb in (#1325)
- Update to version 3.3.14
* feat(appmanager): add appmanager subcommand with PyPI+OSS dual-source by @mengjunwei-mjw in (#1317)
* {Misc} Add --name and update version check message for plugin install and adjust agent detection by @AllyW in (#1316)
- from version 3.3.13
- Update to version 3.3.12
* Add AgentBay CLI command and implement language setting logic by @CodeSpaceiiii in (#1311)
* {Profile} Add external-account-type for user profile by @AllyW in (#1312)
* Implement CLI mock command with add, import, remove, list, clear, and path subcommands by @CodeSpaceiiii in (#1313)
* {Openapi} Add agent segment to user-agent by @AllyW in (#1314)
- from version 3.3.11
* Fix retrySaveProfile function to return success status and update tests by @CodeSpaceiiii in (#1310)
- Update to version 3.3.10
- from version 3.3.9
* {Config} Add safety policy env parsing by @AllyW in (#1307)
- from version 3.3.8
* {Core} Add plugin install --package and plugin show by @AllyW in (#1301)
- from version 3.3.7
* {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile endpoint env injection by @AllyW in (#1304)
- from version 3.3.6
* {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)
- from version 3.3.5
* feat: profile support endpoint flag by @crimson-gao in (#1298)
* {Core} Add aliyun upgrade and configurable plugin index source and fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)
- Update to version 3.3.4
* {Core} Fix unknown-flag parsing for plugin-style subcommands by @AllyW in (#1296)
- from version 3.3.3
* {Core} Add ai-mode and safety policy configuration by @AllyW in (#1295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected aliyun-cli package.

Plugin Details

Severity: High

ID: 370414

File Name: openSUSE-2026-22140-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-63209

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:aliyun-cli

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-63209

Detections

Analytics