The RHACS 4.4.6 release addresses several security vulnerabilities: CVE-2024-24789 involves incorrect handling of certain ZIP files in golang's archive/zip package; CVE-2024-24790 concerns unexpected behavior in golang's net/netip Is methods for IPv4-mapped IPv6 addresses; CVE-2024-34156 is a panic caused by stack exhaustion when decoding deeply nested structures in encoding/gob; CVE-2024-45590 is a denial of service vulnerability in body-parser; and CVE-2024-48910 involves prototype pollution tampering in DOMPurify. These issues were fixed in the updated RHACS 4.4.6 images. The advisory recommends upgrading from versions >=4.4.0 and <4.4.6 to 4.4.6. No known exploits in the wild have been reported.

The vulnerabilities fixed in RHACS 4.4.6 could lead to denial of service conditions (e.g., panic due to stack exhaustion, body-parser DoS), unexpected behavior in IP address handling, and potential tampering via prototype pollution. These issues may affect the stability and security of the RHACS environment, potentially impacting cluster security operations. The severity is rated as Important/High by Red Hat, reflecting significant but not critical impact. No active exploitation has been reported.

Red Hat has released RHACS 4.4.6 which includes fixes for all listed vulnerabilities and a bug fix for image scan result display. Users running RHACS versions >=4.4.0 and <4.4.6 should upgrade to version 4.4.6 promptly to mitigate these security issues. No additional mitigation steps are indicated beyond applying this official patch release.