SUSE-SU-2026:24652-1: important: Security update for aliyun-cli

[SLE-UPDATES]

# Security update for aliyun-cli

Announcement ID: SUSE-SU-2026:24652-1  
Release Date: 2026-11-04T09:26:42Z  
Rating: important  
References:

  * bsc#1288500

  
Cross-References:

  * CVE-2026-116591

  
CVSS scores:

  * CVE-2026-116591 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-116591 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-116591 ( NVD ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  
Affected Products:

  * SUSE Linux Enterprise Server 16.0
  * SUSE Linux Enterprise Server for SAP applications 16.0

  
  
An update that solves one vulnerability can now be installed.

## Description:

This update for aliyun-cli fixes the following issue:

  * CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-
    block zstd frame makes DecodeAll and the streaming decoder panic
    (bsc#1288500).

Update to version 3.5.2:

  * fix: preserve command targets with leading --force by @pl0301 in (#1459)
  * fix(argparser): preserve object-like input in string arrays and stop
    consuming tokens after a complete JSON array by @AllyW in (#1463)
  * fix: read product help endpoints from canonical version metadata by @pl0301
    in (#1466)
  * Fixed the issue of incorrect API parameter name values displayed by \--help
    in non-plugin paths. by @yuexiu94 in (#1470)
  * fix: improve unknown OSS option diagnostics by @PanPanZou in (#1464)
  * fix: surface real pip error when plugin install fails (#1409) by
    @mengjunwei-mjw in (#1479)
  * fix: update Go security baseline and dependencies by @PanPanZou in (#1477)
  * fix: require HTTPS and checksums for plugin package installs by @yndu13 in
    (#1469)
  * fix: OAuth callback binding and add --no-browser login by @AllyW in (#1461)
  * fix: emit structured profile configuration errors in AI mode by @pl0301 in
    (#1476)
  * test: expand CLI unit coverage and failure recovery checks by @PanPanZou in
    (#1478)
  * fix: honor config path when refreshing OAuth and CloudSSO credentials by
    @PanPanZou in (#1468)
  * feat: support CLI credentials in MCP proxy by @PanPanZou in (#1465)
  * Sign release archives and publish an SBOM and provenance for each one by
    @yndu13 in (#1473)
  * fix: clarify safety policy configuration and confirmation boundaries by
    @Winphies in (#1480)
  * feat(openapi): tell "confirmed free" apart from "cannot be quoted" in
    \--estimate-cost by @api-tool-agent in (#1410)
  * feat: apply API metadata read timeout defaults by @pl0301 in (#1475)
  * Add shared CloudSSO sessions across profiles by @AllyW in (#1481)
  * fix: validate JSON parameters as parent values by @Winphies in (#1485)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP applications 16.0  
    zypper in -t patch SUSE-SLES-16.0-2037

  * SUSE Linux Enterprise Server 16.0  
    zypper in -t patch SUSE-SLES-16.0-2037

## Package List:

  * SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64)
    * aliyun-cli-3.5.2-160000.1.1
    * aliyun-cli-debuginfo-3.5.2-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (aarch64 x86_64)
    * aliyun-cli-3.5.2-160000.1.1
    * aliyun-cli-debuginfo-3.5.2-160000.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-116591.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1288500

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20261111/dfa5f846/attachment.htm>