Detections
Analytics

SUSE SLES15 Security Update : aliyun-cli (SUSE-SU-2026:5195-1)

high Nessus Plugin ID 379492

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5195-1 advisory.

 - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283596).
 - CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic (bsc#1288500).

 Update to version 3.5.2:

 * fix: preserve command targets with leading --force by @pl0301 in (#1459)
 * fix(argparser): preserve object-like input in string arrays and stop consuming tokens after a complete JSON array by @AllyW in (#1463)
 * fix: read product help endpoints from canonical version metadata by @pl0301 in (#1466)
 * Fixed the issue of incorrect API parameter name values displayed by
 --help in non-plugin paths. by @yuexiu94 in (#1470)
 * fix: improve unknown OSS option diagnostics by @PanPanZou in (#1464)
 * fix: surface real pip error when plugin install fails (#1409) by @mengjunwei-mjw in (#1479)
 * fix: update Go security baseline and dependencies by @PanPanZou in (#1477)
 * fix: require HTTPS and checksums for plugin package installs by @yndu13 in (#1469)
 * fix: OAuth callback binding and add --no-browser login by @AllyW in (#1461)
 * fix: emit structured profile configuration errors in AI mode by @pl0301 in (#1476)
 * test: expand CLI unit coverage and failure recovery checks by @PanPanZou in (#1478)
 * fix: honor config path when refreshing OAuth and CloudSSO credentials by @PanPanZou in (#1468)
 * feat: support CLI credentials in MCP proxy by @PanPanZou in (#1465)
 * Sign release archives and publish an SBOM and provenance for each one by @yndu13 in (#1473)
 * fix: clarify safety policy configuration and confirmation boundaries by @Winphies in (#1480)
 * feat(openapi): tell 'confirmed free' apart from 'cannot be quoted' in
 --estimate-cost by @api-tool-agent in (#1410)
 * feat: apply API metadata read timeout defaults by @pl0301 in (#1475)
 * Add shared CloudSSO sessions across profiles by @AllyW in (#1481)
 * fix: validate JSON parameters as parent values by @Winphies in (#1485)
 * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable cursors, structured errors with recovery guidance, and non-interactive confirmation handling (#1452).
 * Add offline validation and read-only plans for single-file uploads and single-object deletion; record exact failed targets in exclusive JSONL manifests for cp/sync and expose sync deletion-phase state (#1452).
 * Fix the OSS bridge to preserve option order and `--`, propagate parser and service errors, pass profile region/timeouts/retry budgets, and refresh host credentials at request time without injecting them into argv (#1454).
 * Stop replaying writes after ambiguous transport or server failures; classify retries with jittered backoff, join workers before closing reports, and fix progress data races and failure-report filename collisions (#1452).
 * Enforce the host safety policy for legacy OSS operations and reject unsupported preview combinations (#1452, #1454).
 * Harden policy parsing and environment overrides to fail closed on invalid configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`, or AI mode.
 * Enforce the safety policy before built-in extension dispatch (cliext/safety.go).
 * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
 * API alias canonicalization was reverted and held: aliases and PascalCase/ kebab-case spellings remain separate policy matches, matching command spelling exactly as typed.
 * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: 'v1'`, and return structured startup configuration errors (#1453).
 * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode;
 expand agent detection, User-Agent attribution, and Qoder China CLI detection (#1445, #1455).
 * Support case-insensitive product routing for in-process OpenAPI commands (#1445).
 * Expose regional and VPC product endpoints through queryable product Help (#1448).
 * Support camel RPC flat arrays (#1456) and prefer product prefix/substring suggestions over edit distance in 'Did you mean' output.
 * Upgrade JMESPath to support `json.Number`, preserving large-number comparison and sorting precision and fixing empty-array average semantics.
 * Dispatch newly installed metadata plugins in-process (#1439).
 * Harden plugin archive extraction, package replacement/rollback, and download URL diagnostics (#1442).
 * Redact JSON and form bodies based on content while preserving the encoding of original form stars; keep raw and unparseable dry-run bodies intact (#1440, #1449).
 * Prefer native macOS architecture packages in install.sh (#1433).
 * Keep prerelease tags off the stable latest pointer and fail closed when release asset downloads are incomplete (#1437).
 * Include cliext in required checks, fix cross-platform test failures (#1446), restore single-file entrypoint builds, and stabilize language tests.
 * Update the aliyun-openapi-meta submodule and release jobs.
 * Add the OSS automation guide (en / zh-CN), document startup errors, exit statuses and command-spelling safety matching (#1450), and add the v3.5.1 CHANGELOG entry.
 * docs: add StsToken credential mode to README by @yndu13 in (#1403)
 * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
 * Update Aliyun OpenAPI meta data
 * feat(openapi): extend --estimate-cost coverage (pricing context, SLS/openapi path, oss bridge, by-triple) and scripting contract by @api-tool-agent in (#1399) (no changes)
 * fix(maxc): fall back when symlink creation fails on Windows by @yndu13 in (#1390)
 * fix: quote-aware External process_command parsing by @yndu13 in (#1391)
 * fix: POSIX line-continuation in External process_command splitting by @yndu13 in (#1392)
 * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
 * fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
 * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
 * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
 * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)
 * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
 * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
 * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands by @CodeSpaceiiii in (#1383)
 * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
 * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
 * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
 * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
 * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii with @Copilot in (#1388)
 * Fix invisible API parameter names in help output (bold-black on dark terminals) by @mvanhorn in (#1362)
 * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
 * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)
 * {plugin} Add alias support for plugin by @AllyW in (#1376)
 * feat(mock): add response_body_size for controllable mock stdout size by @yndu13 in (#1378)
 * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)
 * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes by @LCLSpring in (#1373)
 * feat(mock): add delay_ms field to simulate command execution latency by @yndu13 in (#1375)
 * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
 * feat(config): support STS endpoint override for OIDC and role auth by @yndu13 in (#1372)
 * fix: correct valid typo in invalid command error by @yndu13 in (#1365)
 * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external process by @AllyW in (#1366)
 * feat(openapi): add --estimate-cost and list-supported-pricing-apis by @LCLSpring in (#1364)
 * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
 * {cliext} Add aliyun spark-submit by @AllyW in (#1358)
 * feat(acrutil): extract shared binary manager and add diagnosis subcommand by @copyrightpoiiiii in (#1349)
 * [feature] add rostran sub command by @xiao201208 in (#1350)
 * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
 * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
 * Feature/support anonymous by @yuexiu94 in (#1354)
 * feat: support retry-after policy for throttling error by @yndu13 in (#1355)
 * {Plugin} Allow plugins to opt out of host profile enforcement by @AllyW in (#1348)
 * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
 * {Configure} Match policy rules against the command users actually type for ROA by @AllyW in (#1344)
 * {OpenAPI} Add call context logging by @AllyW in (#1342)
 * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
 * feat(appmanager): Generalized PrepareEnv credential pass-through supports multiple authentication modes by @mengjunwei-mjw in (#1341)
 * Improve CMS2 command descriptions and clarify exception return codes by @tingbin-ctb in (#1337)
 * feat(iact3): add iact3 subcommand with manual upgrade by @xiao201208 in (#1336)
 * Add kmscli command by @oobujieshi in (#1340)
 * {Plugin} Support lang and profile from flag for plugin execution by @AllyW in (#1330)
 * Computenest pypi venv by @mengjunwei-mjw in (#1331)
 * feat: add codeup-cli subcommand for migrating third-party code repos by @imu2008 in (#1335)
 * Optimize error messages by @CodeSpaceiiii in (#1327)
 * {Openapi} Return InvalidApiError for unknown API on restful products by @AllyW in (#1326)
 * feat(acrutil): Add Alibaba Cloud Container Registry(ACR) Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
 * {Configure} Support BearerToken profile mode by @AllyW in (#1333)
 * feat add saectl by @Beimingx in (#1319)
 * Cloud Monitor version 2.0: Independent binary access, Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
 * feat(otel): integrate OpenTelemetry support with environment variable by @CodeSpaceiiii in (#1324)
 * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT, AI_USER_AGENT, and OTEL headers have been added. Issues with business parameter passing have been fixed by @tingbin-ctb in (#1325)
 * feat(appmanager): add appmanager subcommand with PyPI+OSS dual-source by @mengjunwei-mjw in (#1317)
 * {Misc} Add --name and update version check message for plugin install and adjust agent detection by @AllyW in (#1316)
 * Add AgentBay CLI command and implement language setting logic by @CodeSpaceiiii in (#1311)
 * {Profile} Add external-account-type for user profile by @AllyW in (#1312)
 * Implement CLI mock command with add, import, remove, list, clear, and path subcommands by @CodeSpaceiiii in (#1313)
 * {Openapi} Add agent segment to user-agent by @AllyW in (#1314)
 * Fix retrySaveProfile function to return success status and update tests by @CodeSpaceiiii in (#1310)
 * {Config} Add safety policy env parsing by @AllyW in (#1307)
 * {Core} Add plugin install --package and plugin show by @AllyW in (#1301)
 * {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile endpoint env injection by @AllyW in (#1304)
 * {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)
 * feat: profile support endpoint flag by @crimson-gao in (#1298)
 * {Core} Add aliyun upgrade and configurable plugin index source and fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)
 * {Core} Fix unknown-flag parsing for plugin-style subcommands by @AllyW in (#1296)
 * {Core} Add ai-mode and safety policy configuration by @AllyW in (#1295)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected aliyun-cli package.

See Also

https://bugzilla.suse.com/1283596

https://bugzilla.suse.com/1284203

https://bugzilla.suse.com/1288500

https://www.suse.com/security/cve/CVE-2026-116591

https://www.suse.com/security/cve/CVE-2026-63209

http://www.nessus.org/u?4f3ea1f8

Plugin Details

Severity: High

ID: 379492

File Name: suse_SU-2026-5195-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.88

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-63209

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-116591

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:aliyun-cli

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/11/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-116591, CVE-2026-63209

SuSE: SUSE-SU-2026:5195-1