openSUSE-SU-2026:22140-1

openSUSE-SU-2026:22140-1 · Security update for aliyun-cli

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

На странице показана часть фактов из источников. Полное описание и список затронутых версий приведены в связанных бюллетенях.

This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283596). Changes for aliyun-cli: - Update to version 3.5.1 * Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable cursors, structured errors with recovery guidance, and non-interactive confirmation handling (#1452). * Add offline validation and read-only plans for single-file uploads and single-object deletion; record exact failed targets in exclusive JSONL manifests for cp/sync and expose sync deletion-phase state (#1452). * Fix the OSS bridge to preserve option order and `--`, propagate parser and service errors, pass profile region/timeouts/retry budgets, and refresh host credentials at request time without injecting them into argv (#1454). * Stop replaying writes after ambiguous transport or server failures; classify retries with jittered backoff, join workers before closing reports, and fix progress data races and failure-report filename collisions (#1452). * Enforce the host safety policy for legacy OSS operations and reject unsupported preview combinations (#1452, #1454). * Harden policy parsing and environment overrides to fail closed on invalid configuration; explicit deny rules cannot be bypassed by `--force`, `--yes`, or AI mode. * Enforce the safety policy before built-in extension dispatch (cliext/safety.go). * Restrict legacy FNF request-signing compatibility to a product allowlist (#1447). * API alias canonicalization was reverted and held: aliases and PascalCase/ kebab-case spellings remain separate policy matches, matching command spelling exactly as typed. * Version AI-mode OpenAPI and OSS error envelopes with `schemaVersion: "v1"`, and return structured startup configuration errors (#1453). * Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode; expand agent detection, User-Agent attribution, and Qoder China CLI detection (#1445, #1455). * Support case-insensitive product routing for in-process OpenAPI commands (#1445). * Expose regional and VPC product endpoints through queryable product Help (#1448). * Support camel RPC flat arrays (#1456) and prefer product prefix/substring suggestions over edit distance in "Did you mean" output. * Upgrade JMESPath to support `json.Number`, preserving large-number comparison and sorting precision and fixing empty-array average semantics. * Dispatch newly installed metadata plugins in-process (#1439). * Harden plugin archive extraction, package replacement/rollback, and download URL diagnostics (#1442). * Redact JSON and form bodies based on content while preserving the encoding of original form stars; keep raw and unparseable dry-run bodies intact (#1440, #1449). * Prefer native macOS architecture packages in install.sh (#1433). * Keep prerelease tags off the stable latest pointer and fail closed when release asset downloads are incomplete (#1437). * Include cliext in required checks, fix cross-platform test failures (#1446), restore single-file entrypoint builds, and stabilize language tests. * Update the aliyun-openapi-meta submodule and release jobs. * Add the OSS automation guide (en / zh-CN), document startup errors, exit statuses and command-spelling safety matching (#1450), and add the v3.5.1 CHANGELOG entry. - from version 3.5.0 * docs: add StsToken credential mode to README by @yndu13 in (#1403) * Built-in plugin and AI MODE enhancement by @yndu13 in (#1411) * Update Aliyun OpenAPI meta data - Update to version 3.4.11 * feat(openapi): extend --estimate-cost coverage (pricing context, SLS/openapi path, oss bridge, by-triple) and scripting contract by @api-tool-agent in (#1399) - from version 3.4.10 (no changes) - from version 3.4.9 * fix(maxc): fall back when symlink creation fails on Windows by @yndu13 in (#1390) * fix: quote-aware External process_command parsing by @yndu13 in (#1391) * fix: POSIX line-continuation in External process_command splitting by @yndu13 in (#1392) * Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394) * fix: atomically write config.json via temp+rename by @yndu13 in (#1387) * fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395) * feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397) * fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398) - Update to version 3.4.8 * fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379) * fix: correct waiter timeout/interval range validation by @yndu13 in (#1382) * feat(openapi): add --cli-dry-run flag for built-in PascalCase commands by @CodeSpaceiiii in (#1383) * fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384) * fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386) * feat: add mseutil command to aliyun CLI by @yndu13 in (#1381) * fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385) * fix: correct import order in openapi/library_test.go by @CodeSpaceiiii with @Copilot in (#1388) * Fix invisible API parameter names in help output (bold-black on dark terminals) by @mvanhorn in (#1362) * feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380) * fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389) - from version 3.4.7 * {plugin} Add alias support for plugin by @AllyW in (#1376) * feat(mock): add response_body_size for controllable mock stdout size by @yndu13 in (#1378) * fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377) - from version 3.4.6 * feat(openapi): add --estimate-cost-context to pass PricingContext to quotes by @LCLSpring in (#1373) * feat(mock): add delay_ms field to simulate command execution latency by @yndu13 in (#1375) - Update to version 3.4.5 * [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345) * feat(config): support STS endpoint override for OIDC and role auth by @yndu13 in (#1372) - from version 3.4.4 * (no changes) - from version 3.4.3 * fix: correct valid typo in invalid command error by @yndu13 in (#1365) * {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external process by @AllyW in (#1366) - from version 3.4.2 * feat(openapi): add --estimate-cost and list-supported-pricing-apis by @LCLSpring in (#1364) - Update to version 3.4.1 * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361) * {cliext} Add aliyun spark-submit by @AllyW in (#1358) - from version 3.4.0 * feat(acrutil): extract shared binary manager and add diagnosis subcommand by @copyrightpoiiiii in (#1349) * [feature] add rostran sub command by @xiao201208 in (#1350) * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306) * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343) * Feature/support anonymous by @yuexiu94 in (#1354) * feat: support retry-after policy for throttling error by @yndu13 in (#1355) - Update to version 3.3.23 * {Plugin} Allow plugins to opt out of host profile enforcement by @AllyW in (#1348) - Update to version 3.3.22 * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346) - from version 3.3.21 * {Configure} Match policy rules against the command users actually type for ROA by @AllyW in (#1344) - from version 3.3.20 * {OpenAPI} Add call context logging by @AllyW in (#1342) - from version 3.3.19 * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332) * feat(appmanager): Generalized PrepareEnv credential pass-through supports multiple authentication modes by @mengjunwei-mjw in (#1341) - from version 3.3.18 * Improve CMS2 command descriptions and clarify exception return codes by @tingbin-ctb in (#1337) * feat(iact3): add iact3 subcommand with manual upgrade by @xiao201208 in (#1336) * Add kmscli command by @oobujieshi in (#134

Есть исправление

Опубликовано

2026-10-19T15:31:50Z

Обновлено

2026-10-22T17:23:12.302647234Z

Стек: system

Проверьте свой сервер →