This Red Hat security advisory for RHACS 4.4.6 addresses several vulnerabilities across multiple components. CVE-2024-24789 concerns improper handling of certain ZIP files in golang's archive/zip package. CVE-2024-24790 involves unexpected behavior in golang's net/netip package for IPv4-mapped IPv6 addresses. CVE-2024-34156 is a stack exhaustion panic triggered by decoding deeply nested structures in golang's encoding/gob package. CVE-2024-45590 is a denial of service vulnerability in the body-parser library. CVE-2024-48910 involves prototype pollution in DOMPurify allowing tampering. The advisory recommends upgrading RHACS 4.4 to version 4.4.6 to apply these fixes. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat.

The vulnerabilities fixed in this update can cause denial of service conditions (e.g., stack exhaustion panic, body-parser DoS), incorrect processing of ZIP files, unexpected network address behavior, and potential tampering via prototype pollution. These issues could affect the stability and security of RHACS deployments, potentially disrupting cluster security operations or allowing manipulation of sanitized content. No known exploits in the wild have been reported at this time.

Red Hat has released RHACS version 4.4.6 which includes fixes for the identified vulnerabilities. Users running earlier versions of RHACS 4.4 are advised to upgrade to this patched release to mitigate these security issues. Since this is a product update, applying the official patch is the recommended remediation. No additional vendor advisories indicate that no action is required or that issues are already mitigated.